# CVE-2026-34461: Sandboxie-Plus stack buffer overflow in SbieIniServer RunSbieCtrl

Source: https://junglewise.ai/threats/cve-2026-34461-sandboxie-plus-stack-buffer-overflow-in-sbieiniserver-runsbiectrl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34461 · Severity: high · CVSS 7.8 · Published 2026-05-05

Sandboxie-Plus is a security tool used to run applications in an isolated environment to prevent them from making permanent changes to the system. A flaw in how the software handles internal messages allows a malicious program already on the computer to crash the security service or potentially take full control of the Windows operating system. This could allow a standard user to gain administrative (SYSTEM) privileges, bypassing security boundaries.

Technologies: [Sandboxie-Plus Sandboxie](https://junglewise.ai/threats/technologies/sandboxie), [Sandboxie-Plus](https://junglewise.ai/threats/technologies/sandboxie-plus). Vendors: [Sandboxie-Plus](https://junglewise.ai/threats/vendors/sandboxie-plus).

## Quick answers

**Is CVE-2026-34461 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34461 being exploited in the wild.

**How severe is CVE-2026-34461?** High severity, with a CVSS score of 7.8, published 5 May 2026.

**Which products and versions are affected?** Sandboxie-Plus <= 1.17.2.

**Is there a fix for CVE-2026-34461?** A patch was published on 2026-05-05: Fixed in version 1.17.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34461 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-34461?** Check whether you run Sandboxie-Plus Sandboxie or Sandboxie-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the SbieIniServer::RunSbieCtrl handler within Sandboxie-Plus versions 1.17.2 and earlier. The vulnerability is triggered when the MSGID_SBIE_INI_RUN_SBIE_CTRL message is processed; for non-sandboxed callers, the handler uses memcpy to copy the message payload into a fixed-size 128-character WCHAR buffer (ctrlCmd) without length validation. Because the service pipe is created with a NULL DACL, any local interactive process can connect to the pipe and send an oversized payload. Successful exploitation can lead to local privilege escalation (LPE) to SYSTEM or a crash of the SbieSvc service. The issue is resolved in version 1.17.3.

## Affected products

- sandboxie-plus Sandboxie-Plus <= 1.17.2

## Timeline

- 2026-05-04: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE-2026-34461 published
- 2026-05-05: patched: Fixed in version 1.17.3

## References

- [https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-wpjw-jh2p-gwx7](https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-wpjw-jh2p-gwx7)

## Related threats

- [Sandboxie-Plus sandbox escape via APC injection in GuiServer](https://junglewise.ai/threats/cve-2026-45313-sandboxie-plus-sandbox-escape-via-apc-injection-in-guiserver)
- [Sandboxie-Plus privilege escalation via TOCTOU in UpdUtil](https://junglewise.ai/threats/cve-2026-34596-sandboxie-plus-privilege-escalation-via-toctou-in-updutil)
- [Sandboxie-Plus entropy loss in EditPassword hashing](https://junglewise.ai/threats/cve-2026-34527-sandboxie-plus-entropy-loss-in-editpassword-hashing)
- [Sandboxie-Plus stack overflow in NamedPipeServer OpenHandler](https://junglewise.ai/threats/cve-2026-34464-sandboxie-plus-stack-overflow-in-namedpipeserver-openhandler)
- [Sandboxie-Plus stack buffer overflow in ProcessServer](https://junglewise.ai/threats/cve-2026-34462-sandboxie-plus-stack-buffer-overflow-in-processserver)