Read the docs
TI-2026-25112 Aliases CVE-2026-32603

Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process

Priority HIGH 69CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the Sandboxie kernel driver. An unprivileged process running inside a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriverApi driver, triggering an immediate kernel crash (BSOD). The vulnerability affects the Standard Sandbox configuration both with and without dropped administrator privileges, but does not affect the Security Hardened Sandbox configuration. This issue has been fixed in version 1.17.3. Users who cannot update can use the Security Hardened Sandbox configuration as a workaround.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Sandboxie (sandboxie-plus): 1.17.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sandboxie-plusSandboxiebefore 1.17.31.17.3Patch availableCNA
  • Sandboxie Vendorsandboxie-plus Affected before 1.17.3 Fixed in 1.17.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*before 1.17.3Vulnerablesandboxie-plus
  • cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:* Versions before 1.17.3 Vulnerable ·sandboxie-plus

Remediation

  • Fix · CNA Sandboxie (sandboxie-plus) Fixed in 1.17.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32603

References

Exploit 1

Other 1

  • TI-2025-40067 Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise CVSS 4.0CRITICAL 9.9
  • TI-2026-26723 Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly CVSS 4.0CRITICAL 9.3
  • TI-2024-32948 Path traversal in Sandboxie CVSS 3.1CRITICAL 9.2
  • TI-2026-26724 Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave CVSS 4.0HIGH 8.8
  • TI-2025-29386 Sandboxie Arbitrary Kernel Write in SbieDrv.sys API (API_GET_SECURE_PARAM) CVSS 3.1HIGH 7.8
  • TI-2025-29385 Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_GET_SECURE_PARAM) CVSS 3.1HIGH 7.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences