# CVE-2026-32603: Sandboxie kernel driver denial of service via malformed IOCTL

Source: https://junglewise.ai/threats/cve-2026-32603-sandboxie-kernel-driver-denial-of-service-via-malformed-ioctl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-32603 · Severity: medium · CVSS 6.5 · Published 2026-05-05

Sandboxie is a security tool used to run applications in an isolated environment (sandbox) to prevent them from making permanent changes to the computer. A flaw in its core driver allows a program running inside a standard sandbox to crash the entire Windows operating system, leading to a Blue Screen of Death (BSOD). This results in an immediate loss of unsaved data and a complete disruption of business operations on the affected machine.

Technologies: [Sandboxie-Plus Sandboxie](https://junglewise.ai/threats/technologies/sandboxie), [Sandboxie-Plus](https://junglewise.ai/threats/technologies/sandboxie-plus). Vendors: [Sandboxie-Plus](https://junglewise.ai/threats/vendors/sandboxie-plus).

## Quick answers

**Is CVE-2026-32603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32603 being exploited in the wild.

**How severe is CVE-2026-32603?** Medium severity, with a CVSS score of 6.5, published 5 May 2026.

**Which products and versions are affected?** Sandboxie-Plus Sandboxie Classic <= 5.72.2; Sandboxie-Plus <= 1.17.2.

**Is there a fix for CVE-2026-32603?** A patch was published on 2026-03-29: Version 1.17.3 released with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32603 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-32603?** Check whether you run Sandboxie-Plus Sandboxie, Sandboxie-Plus Sandboxie Classic or Sandboxie-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local denial of service (DoS) vulnerability exists in the Sandboxie kernel driver (SbieDrv.sys) due to improper input validation. An unprivileged process running within a 'Standard Sandbox' configuration can issue a malformed IOCTL (0x222007) to the '\\Device\\SandboxieDriverApi' device. This triggers a failure in the API_INVOKE_SYSCALL routing, potentially causing a Supervisor Mode Access Prevention (SMAP) violation or a corrupted SEH stack unwind, leading to an 'ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY' bug check. The vulnerability does not affect 'Security Hardened' sandbox configurations. A fix is available in Sandboxie-Plus version 1.17.3 and Sandboxie Classic 5.72.3.

## Affected products

- sandboxie-plus Sandboxie-Plus <= 1.17.2
- sandboxie-plus Sandboxie Classic <= 5.72.2

## Timeline

- 2026-03-29: patched: Version 1.17.3 released with security fixes.
- 2026-05-04: advisory: Project maintainer published security advisory GHSA-vvf8-cf4j-v8fv.
- 2026-05-05: disclosed: CVE-2026-32603 published.

## References

- [https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3](https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3)
- [https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vvf8-cf4j-v8fv](https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vvf8-cf4j-v8fv)

## Related threats

- [Sandboxie-Plus sandbox escape via APC injection in GuiServer](https://junglewise.ai/threats/cve-2026-45313-sandboxie-plus-sandbox-escape-via-apc-injection-in-guiserver)
- [Sandboxie-Plus privilege escalation via TOCTOU in UpdUtil](https://junglewise.ai/threats/cve-2026-34596-sandboxie-plus-privilege-escalation-via-toctou-in-updutil)
- [Sandboxie-Plus entropy loss in EditPassword hashing](https://junglewise.ai/threats/cve-2026-34527-sandboxie-plus-entropy-loss-in-editpassword-hashing)
- [Sandboxie-Plus stack overflow in NamedPipeServer OpenHandler](https://junglewise.ai/threats/cve-2026-34464-sandboxie-plus-stack-overflow-in-namedpipeserver-openhandler)
- [Sandboxie-Plus stack buffer overflow in ProcessServer](https://junglewise.ai/threats/cve-2026-34462-sandboxie-plus-stack-buffer-overflow-in-processserver)