Vulnerabilities

TI-2026-26843 CVE-2026-34596

Sandboxie-Plus local privilege escalation via TOCTOU race condition in UpdUtil addon installation

MEDIUM 60

Sandboxie-Plus is an open source sandbox-based isolation software for Windows.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00106 Published 2026-05-05 Fixed in 1.17.3 CWE-367

TI-2026-26776 CVE-2026-34527

Sandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extraction

MEDIUM 44

Sandboxie-Plus is an open source sandbox-based isolation software for Windows.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00091 Published 2026-05-05 Fixed in 1.17.3 CWE-328

TI-2026-26729 CVE-2026-34464

Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field

LOW 39

Sandboxie-Plus is an open source sandbox-based isolation software for Windows.

CVSS 4.0HIGH 8.8 Local Low privileges No interaction EPSS 0.00174 Published 2026-05-05 Fixed in 1.17.3 CWE-121

TI-2026-26727 CVE-2026-34462

Sandboxie-Plus ProcessServer boxname stack buffer overflows via unterminated wide string copy

LOW 33

Sandboxie-Plus is an open source sandbox-based isolation software for Windows.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00174 Published 2026-05-05 Fixed in 1.17.3 CWE-121

TI-2026-26726 CVE-2026-34461

Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation

LOW 33

Sandboxie-Plus is an open source sandbox-based isolation software for Windows.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00172 Published 2026-05-05 Fixed in 1.17.3 CWE-121

TI-2026-26724 CVE-2026-34459

Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave

HIGH 73

Sandboxie-Plus is an open source sandbox-based isolation software for Windows.

CVSS 4.0HIGH 8.8 Local Low privileges No interaction EPSS 0.00139 Published 2026-05-05 Fixed in 1.17.3 CWE-121

TI-2026-26723 CVE-2026-34458

Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly

HIGH 75

Sandboxie-Plus is an open source sandbox-based isolation software for Windows.

CVSS 4.0CRITICAL 9.3 Local Low privileges No interaction EPSS 0.00251 Published 2026-05-05 Fixed in 1.17.3 CWE-93

TI-2026-25112 CVE-2026-32603

Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process

HIGH 69

Sandboxie is an open source sandbox-based isolation software for Windows.

CVSS 4.0HIGH 8.2 Local Low privileges No interaction EPSS 0.00152 Published 2026-05-05 Fixed in 1.17.3 CWE-20

TI-2019-15604 CVE-2019-25551 · GHSA-2fhg-mfw9-px88

Sandboxie 5.30 Denial of Service via Program Alerts Buffer Overflow

MEDIUM 64

Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Program Alerts configuration field.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00176 Published 2026-03-21 No fix listed CWE-1282

TI-2025-40067 CVE-2025-64721