sandboxie-plus Sandboxie up to 1.17.5 GuiServer GuiServer.cpp WndHookRegisterSlave hthread/hproc

Summaryinfo

A vulnerability was found in sandboxie-plus Sandboxie up to 1.17.5. It has been declared as very critical. Affected by this vulnerability is the function WndHookRegisterSlave of the file Sandboxie/core/svc/GuiServer.cpp of the component GuiServer. The manipulation of the argument hthread/hproc results in sandbox. This vulnerability is cataloged as CVE-2026-45313. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in sandboxie-plus Sandboxie up to 1.17.5. Affected is the function WndHookRegisterSlave of the file Sandboxie/core/svc/GuiServer.cpp of the component GuiServer. The manipulation of the argument hthread/hproc with an unknown input leads to a sandbox vulnerability. CWE is classifying the issue as CWE-265. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread belongs to the sandboxed process or that the function pointer is in the caller address space, and GuiServer::WndHookNotifySlave then calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, (ULONG_PTR)req->threadid) as SYSTEM, allowing a sandboxed process to execute arbitrary code in an unsandboxed host process. This issue is fixed in version 1.17.6.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-45313 since 05/11/2026. The exploitability is told to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/16/2026). This vulnerability is assigned to T1611 by the MITRE ATT&CK project.

Upgrading to version 1.17.6 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• sandboxie-plus

Name

• Sandboxie

Version

• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5

Website

• Product: https://github.com/sandboxie-plus/Sandboxie/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion