EUVD-2026-27456Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.
AnalysisAI
INI injection in Sandboxie-Plus versions 1.17.2 and earlier enables any local low-privilege user to bypass EditAdminOnly and ConfigPassword protections, inject malicious directives into the global Sandboxie.ini file, create unrestricted sandbox sections, and escalate to SYSTEM privileges. The background service fails to authorize IPC messages for UserSettings_* sections and does not sanitize CRLF characters in MSGID_SBIE_INI_ADD_SETTING and MSGID_SBIE_INI_SET_SETTING parameters, allowing section header injection. Fixed in version 1.17.3 released by the vendor. No CISA KEV listing or public exploit identified at time of analysis, but technical details in GitHub advisory provide sufficient information for exploit development.
Technical ContextAI
Sandboxie-Plus is a Windows sandbox isolation application that uses a background service (running as SYSTEM) to enforce sandbox policies defined in Sandboxie.ini. The vulnerability exists in the service's IPC message handling for configuration updates. The root cause is CWE-93 (Improper Neutralization of CRLF Sequences), where the service accepts MSGID_SBIE_INI_ADD_SETTING and MSGID_SBIE_INI_SET_SETTING messages targeting UserSettings_* sections without proper authorization, and fails to sanitize carriage return/line feed characters in value or setting name parameters. An attacker can inject literal CRLF sequences to break out of the intended UserSettings_ section and write arbitrary configuration sections, including new sandbox definitions with elevated permissions (e.g., DropAdminRights=N, OpenWinClass=*). This transforms a restricted user-settings capability into full configuration file write access.
RemediationAI
Upgrade to Sandboxie-Plus version 1.17.3 or later, released by the vendor to resolve CVE-2026-34458 and additional security issues including CVE-2026-32603, ProcessServer name validation weaknesses, and NamedPipeServer parameter validation flaws. Download from official GitHub release page: https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3. If immediate patching is not feasible, restrict local user access to systems running Sandboxie-Plus and audit user accounts with local logon rights-compensating controls are limited since the vulnerability requires only standard user credentials. Note that version 1.17.3 also introduces salted SHA-256 password hashing for EditPassword, but existing passwords remain in weaker format until manually changed; administrators should rotate ConfigPassword after upgrading to benefit from improved entropy.
Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershe
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Rated high sev
Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supply
Stack-based buffer overflow in Sandboxie-Plus SbieSvc service enables sandboxed processes to escape isolation and execut
Stack buffer overflow in Sandboxie-Plus SbieSvc proxy service enables SYSTEM privilege escalation from sandboxed process
An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in t
Local denial of service in Sandboxie 1.17.2 and earlier allows unprivileged processes inside Standard Sandbox configurat
Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or pro
Sandbox escape with SYSTEM-level code execution in Sandboxie-Plus before 1.17.6 allows a process confined inside a sandb
Stack-based buffer overflow in Sandboxie-Plus ProcessServer handlers allows local authenticated attackers to execute arb
Local privilege escalation to SYSTEM in Sandboxie-Plus 1.17.2 and earlier allows low-privileged interactive users to tri
Sandboxie-Plus versions 1.17.2 and earlier are vulnerable to privilege escalation via a Time-of-Check-to-Time-of-Use (TO
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today