Executive brief
Sandboxie-Plus is a security tool used to run applications in an isolated environment to protect the rest of the computer. A flaw in how it installs optional add-ons allows a standard user to trick the system into running malicious code with the highest possible administrative privileges (SYSTEM). This could allow an attacker to take full control of the computer without triggering any security warnings or administrator prompts.
Technical details
A Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists in the UpdUtil.exe component of Sandboxie-Plus during addon installation. When a user initiates an addon install via the SandMan interface, the SbieSvc service spawns UpdUtil.exe with SYSTEM privileges. However, the utility stages installation files in the user-writable %TEMP%\sandboxie-updater directory. While UpdUtil verifies the SHA-256 hashes of the downloaded files against a signed manifest, there is a timing window between this verification and the subsequent extraction/execution by install.bat. An unprivileged local attacker can replace the verified 'files.cab' with a malicious version, leading to arbitrary code execution as NT AUTHORITY\SYSTEM without a UAC prompt. This issue is resolved in version 1.17.3.
Affected products
- sandboxie-plus Sandboxie-Plus <= 1.17.2
Timeline
- 2026-05-04: advisory: Vendor advisory published on GitHub
- 2026-05-05: disclosed: CVE published to NVD
- 2026-05-05: patched: Fixed in version 1.17.3