Read the docs
TI-2026-26723 Aliases CVE-2026-34458

Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly

Priority HIGH 75CWE-93Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Sandboxie (sandboxie-plus): 1.17.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sandboxie-plusSandboxiebefore 1.17.31.17.3Patch availableCNA
  • Sandboxie Vendorsandboxie-plus Affected before 1.17.3 Fixed in 1.17.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*before 1.17.3Vulnerablesandboxie-plus
  • cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:* Versions before 1.17.3 Vulnerable ·sandboxie-plus

Remediation

  • Fix · CNA Sandboxie (sandboxie-plus) Fixed in 1.17.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34458

References

Exploit 1

Patch 1

  • TI-2025-40067 Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise CVSS 4.0CRITICAL 9.9
  • TI-2024-32948 Path traversal in Sandboxie CVSS 3.1CRITICAL 9.2
  • TI-2026-26724 Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave CVSS 4.0HIGH 8.8
  • TI-2026-25112 Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process CVSS 4.0HIGH 8.2
  • TI-2025-29386 Sandboxie Arbitrary Kernel Write in SbieDrv.sys API (API_GET_SECURE_PARAM) CVSS 3.1HIGH 7.8
  • TI-2025-29385 Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_GET_SECURE_PARAM) CVSS 3.1HIGH 7.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences