Read the docs
TI-2025-40067 Aliases CVE-2025-64721

Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise

Priority HIGH 82CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the SYSTEM-level service SbieSvc.exe exposes SbieIniServer::RC4Crypt to sandboxed processes. The handler adds a fixed header size to a caller-controlled value_len without overflow checking. A large value_len (e.g., 0xFFFFFFF0) wraps the allocation size, causing a heap overflow when attacker data is copied into the undersized buffer. This allows sandboxed processes to execute arbitrary code as SYSTEM, fully compromising the host. This issue is fixed in version 1.16.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00717 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Sandboxie (sandboxie-plus): 1.16.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sandboxie-plusSandboxiebefore 1.16.71.16.7Patch availableCNA
  • Sandboxie Vendorsandboxie-plus Affected before 1.16.7 Fixed in 1.16.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*1.14.0 to before 1.16.7Vulnerablesandboxie-plus
  • cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:* Versions 1.14.0 to before 1.16.7 Vulnerable ·sandboxie-plus

Remediation

  • Fix · CNA Sandboxie (sandboxie-plus) Fixed in 1.16.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64721

References

Exploit 1

Patch 1

Other 1

  • TI-2026-26723 Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly CVSS 4.0CRITICAL 9.3
  • TI-2024-32948 Path traversal in Sandboxie CVSS 3.1CRITICAL 9.2
  • TI-2026-26724 Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave CVSS 4.0HIGH 8.8
  • TI-2026-25112 Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process CVSS 4.0HIGH 8.2
  • TI-2025-29386 Sandboxie Arbitrary Kernel Write in SbieDrv.sys API (API_GET_SECURE_PARAM) CVSS 3.1HIGH 7.8
  • TI-2025-29385 Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_GET_SECURE_PARAM) CVSS 3.1HIGH 7.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences