CVE-2025-64721: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions…
CVE-2025-64721 · Severity: critical · CVSS 10 · Published 2025-12-11
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the SYSTEM-level service SbieSvc.exe exposes SbieIniServer::RC4Crypt to sandboxed processes. The handler adds a fixed header size to a caller-controlled value_len without overflow checking. A large value_len (e.g., 0xFFFFFFF0) wraps the allocation size, causing a heap overflow when attacker data is copied into the undersized buffer. This allows sandboxed processes to execute arbitrary code as SYSTEM, fully compromising the host. This issue is fixed in version 1.16.7.
No. Junglewise Threat Intelligence has no report of CVE-2025-64721 being exploited in the wild.
How severe is CVE-2025-64721?
Critical severity, with a CVSS score of 10, published 11 December 2025.
Which products and versions are affected?
Sandboxie-Plus Sandboxie. The advisory does not name versions.
Is there a fix for CVE-2025-64721?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-64721?
Check whether you run Sandboxie-Plus Sandboxie. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.