CVE-2026-32603: Sandboxie kernel driver denial of service via malformed IOCTL

CVE-2026-32603 · Severity: medium · CVSS 6.5 · Published 2026-05-05

Sandboxie is a security tool used to run applications in an isolated environment (sandbox) to prevent them from making permanent changes to the computer. A flaw in its core driver allows a program running inside a standard sandbox to crash the entire Windows operating system, leading to a Blue Screen of Death (BSOD). This results in an immediate loss of unsaved data and a complete disruption of business operations on the affected machine.

Technologies: Sandboxie-Plus Sandboxie, Sandboxie-Plus. Vendors: Sandboxie-Plus.

Quick answers

Is CVE-2026-32603 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32603 being exploited in the wild.
How severe is CVE-2026-32603?
Medium severity, with a CVSS score of 6.5, published 5 May 2026.
Which products and versions are affected?
Sandboxie-Plus Sandboxie Classic <= 5.72.2; Sandboxie-Plus <= 1.17.2.
Is there a fix for CVE-2026-32603?
A patch was published on 2026-03-29: Version 1.17.3 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32603 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-32603?
Check whether you run Sandboxie-Plus Sandboxie, Sandboxie-Plus Sandboxie Classic or Sandboxie-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local denial of service (DoS) vulnerability exists in the Sandboxie kernel driver (SbieDrv.sys) due to improper input validation. An unprivileged process running within a 'Standard Sandbox' configuration can issue a malformed IOCTL (0x222007) to the '\\Device\\SandboxieDriverApi' device. This triggers a failure in the API_INVOKE_SYSCALL routing, potentially causing a Supervisor Mode Access Prevention (SMAP) violation or a corrupted SEH stack unwind, leading to an 'ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY' bug check. The vulnerability does not affect 'Security Hardened' sandbox configurations. A fix is available in Sandboxie-Plus version 1.17.3 and Sandboxie Classic 5.72.3.

Affected products

  • sandboxie-plus Sandboxie-Plus <= 1.17.2
  • sandboxie-plus Sandboxie Classic <= 5.72.2

Timeline

  • 2026-03-29: patched: Version 1.17.3 released with security fixes.
  • 2026-05-04: advisory: Project maintainer published security advisory GHSA-vvf8-cf4j-v8fv.
  • 2026-05-05: disclosed: CVE-2026-32603 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.