Executive brief
Sandboxie-Plus is a security tool used to run applications in an isolated environment (a 'sandbox') to prevent them from making permanent changes to the underlying Windows system. A vulnerability in the software's background service allows a program running inside the sandbox to break out and execute commands with high-level SYSTEM privileges. This could allow malicious software to bypass security restrictions, crash the system service, or gain full control over the host computer.
Technical details
A stack-based buffer overflow exists in the `NamedPipeServer::OpenHandler` function within the Sandboxie-Plus service (`SbieSvc`). The vulnerability is caused by the use of `wcscat` to copy the `server` field from a `NAMED_PIPE_OPEN_REQ` structure into a fixed-size `WCHAR pipename[160]` stack buffer without verifying null termination or length. Because the service pipe accepts variable-length messages, a local attacker within a sandbox can craft a request where the `server` field is not null-terminated and is followed by malicious data. This causes `wcscat` to read past the intended field and overflow the stack buffer. Successful exploitation allows for a sandbox escape and arbitrary code execution in the context of the SYSTEM service. The issue is addressed in version 1.17.3 by implementing proper bounds checking.
Affected products
- sandboxie-plus Sandboxie-Plus <= 1.17.2
Timeline
- 2026-05-04: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE published to NVD
- 2026-05-05: patched: Fixed in version 1.17.3