← Vulnerability feed

Vulnerability record · CVE-2026-34462 · published 5 May 2026

CVE-2026-34462: Sandboxie-plus sandboxie stack-based buffer overflow vulnerability

Sandboxie Plus · Sandboxie

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from request structures into WCHAR[40] stack buffers using wcscpy without verifying null termination. Because the service pipe accepts variable-length packets larger than the request structure, an attacker can fill the boxname field with non-zero data and append additional controlled wide characters after the structure. wcscpy then reads past the fixed field and overflows the destination stack buffer. The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy occurs before authorization checks. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

7.3 CVSS 4.0 High EPSS 0.16% · top 96.0% CWE-121 · Stack-based buffer overflowCWE-170 · CWE-170
7.3CVSS 4.0 base score
0.16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
24 Jul 2026Last modified by NVD

Description

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from request structures into WCHAR[40] stack buffers using wcscpy without verifying null termination. Because the service pipe accepts variable-length packets larger than the request structure, an attacker can fill the boxname field with non-zero data and append additional controlled wide characters after the structure. wcscpy then reads past the fixed field and overflows the destination stack buffer. The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy occurs before authorization checks. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-9cjg-vh9m-hhx4 ExploitMitigationVendor Advisory

Track CVE-2026-34462 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2018-18748Sandboxie-plus sandboxie vulnerabilitySandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE…EPSS 2.4%9.9CVE-2025-64721Sandboxie-plus sandboxie integer overflow vulnerabilitySandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the SYSTEM-le…EPSS 0.72%9.3CVE-2026-34458Sandboxie-plus sandboxie vulnerabilitySandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows …EPSS 0.29%8.8CVE-2026-34459Sandboxie-plus sandboxie stack-based buffer overflow vulnerabilitySandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInpu…EPSS 0.15%8.8CVE-2026-34464Sandboxie-plus sandboxie stack-based buffer overflow vulnerabilitySandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies th…EPSS 0.16%8.4CVE-2024-49360Sandboxie-plus sandboxie path traversal vulnerabilitySandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no p…EPSS 0.49%8.2CVE-2026-32603Sandboxie-plus sandboxie improper input validation vulnerabilitySandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exi…EPSS 0.16%7.8CVE-2025-46715Sandboxie-plus sandboxie out-of-bounds write vulnerabilitySandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to vers…EPSS 0.23%

Source: NIST National Vulnerability Database (record CVE-2026-34462), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.