Is CVE-2026-34527 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34527 being exploited in the wild.

How severe is CVE-2026-34527?

Medium severity, with a CVSS score of 5.3, published 5 May 2026.

Is there a fix for CVE-2026-34527?

A patch was published on 2026-05-05: Fixed in version 1.17.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34527 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-34527?

Check whether you run Sandboxie-Plus Sandboxie or Sandboxie-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34527: Sandboxie-Plus entropy loss in EditPassword hashing

CVE-2026-34527 · Severity: medium · CVSS 5.3 · Published 2026-05-05

Sandboxie-Plus is a security tool used to run applications in an isolated environment to prevent them from making permanent changes to the system. A flaw in how the software stores passwords allows for much easier unauthorized access if an attacker obtains a backup or copy of the configuration file. Because of a coding error, the security of these stored passwords is significantly weaker than intended, making them vulnerable to rapid guessing attacks.

Technologies: Sandboxie-Plus Sandboxie, Sandboxie-Plus. Vendors: Sandboxie-Plus.

Quick answers

Is CVE-2026-34527 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34527 being exploited in the wild.
How severe is CVE-2026-34527?: Medium severity, with a CVSS score of 5.3, published 5 May 2026.
Which products and versions are affected?: Sandboxie-Plus <= 1.17.2.
Is there a fix for CVE-2026-34527?: A patch was published on 2026-05-05: Fixed in version 1.17.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34527 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-34527?: Check whether you run Sandboxie-Plus Sandboxie or Sandboxie-Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error exists in the SbieIniServer::HashPassword function within Sandboxie/core/svc/sbieiniserver.cpp. When converting a SHA-1 digest to hexadecimal, the high nibble of each byte is shifted right by 8 bits instead of 4, resulting in the high nibble always being zero. This effectively discards half of the digest information, reducing entropy to 80 bits. Combined with the use of unsalted SHA-1, this significantly lowers the computational cost for offline brute-force attacks against leaked or backed-up EditPassword hashes. The issue is resolved in version 1.17.3 by correcting the bit-shift and recommending a migration to stronger hashing schemes.

Affected products

Sandboxie-Plus Sandboxie-Plus <= 1.17.2

Timeline

2026-05-04: advisory: GitHub advisory GHSA-w37h-qm9p-h4x2 published
2026-05-05: disclosed: CVE-2026-34527 assigned
2026-05-05: patched: Fixed in version 1.17.3

References

https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w37h-qm9p-h4x2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.