# CVE-2026-34464: Sandboxie-Plus stack overflow in NamedPipeServer OpenHandler

Source: https://junglewise.ai/threats/cve-2026-34464-sandboxie-plus-stack-overflow-in-namedpipeserver-openhandler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34464 · Severity: high · CVSS 8.8 · Published 2026-05-05

Sandboxie-Plus is a security tool used to run applications in an isolated environment (a 'sandbox') to prevent them from making permanent changes to the underlying Windows system. A vulnerability in the software's background service allows a program running inside the sandbox to break out and execute commands with high-level SYSTEM privileges. This could allow malicious software to bypass security restrictions, crash the system service, or gain full control over the host computer.

Technologies: [Sandboxie-Plus Sandboxie](https://junglewise.ai/threats/technologies/sandboxie), [Sandboxie-Plus](https://junglewise.ai/threats/technologies/sandboxie-plus). Vendors: [Sandboxie-Plus](https://junglewise.ai/threats/vendors/sandboxie-plus).

## Quick answers

**Is CVE-2026-34464 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34464 being exploited in the wild.

**How severe is CVE-2026-34464?** High severity, with a CVSS score of 8.8, published 5 May 2026.

**Which products and versions are affected?** Sandboxie-Plus <= 1.17.2.

**Is there a fix for CVE-2026-34464?** A patch was published on 2026-05-05: Fixed in version 1.17.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34464 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-34464?** Check whether you run Sandboxie-Plus Sandboxie or Sandboxie-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the `NamedPipeServer::OpenHandler` function within the Sandboxie-Plus service (`SbieSvc`). The vulnerability is caused by the use of `wcscat` to copy the `server` field from a `NAMED_PIPE_OPEN_REQ` structure into a fixed-size `WCHAR pipename[160]` stack buffer without verifying null termination or length. Because the service pipe accepts variable-length messages, a local attacker within a sandbox can craft a request where the `server` field is not null-terminated and is followed by malicious data. This causes `wcscat` to read past the intended field and overflow the stack buffer. Successful exploitation allows for a sandbox escape and arbitrary code execution in the context of the SYSTEM service. The issue is addressed in version 1.17.3 by implementing proper bounds checking.

## Affected products

- sandboxie-plus Sandboxie-Plus <= 1.17.2

## Timeline

- 2026-05-04: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE published to NVD
- 2026-05-05: patched: Fixed in version 1.17.3

## References

- [https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-cf8x-f33g-vwfg](https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-cf8x-f33g-vwfg)

## Related threats

- [Sandboxie-Plus sandbox escape via APC injection in GuiServer](https://junglewise.ai/threats/cve-2026-45313-sandboxie-plus-sandbox-escape-via-apc-injection-in-guiserver)
- [Sandboxie-Plus privilege escalation via TOCTOU in UpdUtil](https://junglewise.ai/threats/cve-2026-34596-sandboxie-plus-privilege-escalation-via-toctou-in-updutil)
- [Sandboxie-Plus entropy loss in EditPassword hashing](https://junglewise.ai/threats/cve-2026-34527-sandboxie-plus-entropy-loss-in-editpassword-hashing)
- [Sandboxie-Plus stack buffer overflow in ProcessServer](https://junglewise.ai/threats/cve-2026-34462-sandboxie-plus-stack-buffer-overflow-in-processserver)
- [Sandboxie-Plus stack buffer overflow in SbieIniServer RunSbieCtrl](https://junglewise.ai/threats/cve-2026-34461-sandboxie-plus-stack-buffer-overflow-in-sbieiniserver-runsbiectrl)