Sandboxie Plus v0.7.2 - 'SbieSvc' Unquoted Service Path
Priority HIGH 72CWE-428Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-428.
Summary
Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with LocalSystem permissions during service startup.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sandboxie-plus | Sandboxie Plus | 0.7.2 | — | No fix listed | CNA |
- Sandboxie Plus Vendorsandboxie-plus Affected 0.7.2 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-47883
- 2026-10-03 Alias added: GHSA-jcwp-q8h7-72pm
References
Exploit 1
Other 1
More sandboxie-plus vulnerabilities
- TI-2025-40067 Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise CVSS 4.0CRITICAL 9.9
- TI-2026-26723 Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly CVSS 4.0CRITICAL 9.3
- TI-2024-32948 Path traversal in Sandboxie CVSS 3.1CRITICAL 9.2
- TI-2026-26724 Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave CVSS 4.0HIGH 8.8
- TI-2026-33112 Sandboxie-Plus: Sandboxie APC Injection Sandbox Escape CVSS 3.1HIGH 7.7
- TI-2026-25112 Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process CVSS 4.0HIGH 8.2
Sources
- CVE-2021-47883 · CVE Program
- CVE-2021-47883 · NVD
- FIRST EPSS
- GHSA-jcwp-q8h7-72pm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences