Executive brief
Sandboxie is a security tool used to run applications in an isolated environment (sandbox) to prevent them from making permanent changes to the computer. A flaw in its core driver allows a program running inside a standard sandbox to crash the entire Windows operating system, leading to a Blue Screen of Death (BSOD). This results in an immediate loss of unsaved data and a complete disruption of business operations on the affected machine.
Technical details
A local denial of service (DoS) vulnerability exists in the Sandboxie kernel driver (SbieDrv.sys) due to improper input validation. An unprivileged process running within a 'Standard Sandbox' configuration can issue a malformed IOCTL (0x222007) to the '\\Device\\SandboxieDriverApi' device. This triggers a failure in the API_INVOKE_SYSCALL routing, potentially causing a Supervisor Mode Access Prevention (SMAP) violation or a corrupted SEH stack unwind, leading to an 'ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY' bug check. The vulnerability does not affect 'Security Hardened' sandbox configurations. A fix is available in Sandboxie-Plus version 1.17.3 and Sandboxie Classic 5.72.3.
Affected products
- sandboxie-plus Sandboxie-Plus <= 1.17.2
- sandboxie-plus Sandboxie Classic <= 5.72.2
Timeline
- 2026-03-29: patched: Version 1.17.3 released with security fixes.
- 2026-05-04: advisory: Project maintainer published security advisory GHSA-vvf8-cf4j-v8fv.
- 2026-05-05: disclosed: CVE-2026-32603 published.