Executive brief
Sandboxie-Plus is a security tool used to run applications in an isolated environment to protect the rest of the Windows operating system. A flaw in how the software handles internal communication allows a local user to send specially crafted messages that overflow the system's memory. This can lead to a complete crash of the security service or allow an attacker to gain full administrative control (SYSTEM privileges) over the computer.
Technical details
A stack-based buffer overflow exists in Sandboxie-Plus versions 1.17.2 and earlier within the ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler). The vulnerability is caused by the use of 'wcscpy' to copy a WCHAR boxname[34] field from a request structure into a WCHAR[40] stack buffer without verifying null termination. Because the service pipe is created with a NULL DACL and accepts variable-length packets larger than the request structure, a local attacker can append controlled data after the structure to trigger the overflow. This occurs before authorization checks, potentially allowing an unprivileged local user to execute arbitrary code with SYSTEM privileges. The issue is addressed in version 1.17.3.
Affected products
- sandboxie-plus Sandboxie-Plus <= 1.17.2
Timeline
- 2026-05-04: advisory: GitHub advisory published by maintainer
- 2026-05-05: disclosed: CVE-2026-34462 published
- 2026-05-05: patched: Fixed in version 1.17.3