Sandboxie-Plus CVE-2026-34464

Sandboxie-Plus is a Windows sandbox isolation tool that uses a kernel driver and user-mode service (SbieSvc) running as SYSTEM to intercept and restrict sandboxed process operations. The vulnerability resides in the named pipe IPC handler that processes NAMED_PIPE_OPEN_REQ messages from sandboxed processes. The NamedPipeServer::OpenHandler function uses the unsafe wcscat function to concatenate wide-character strings into a fixed WCHAR pipename[160] stack buffer without validating null termination of the source. The server[48] field from the request structure is treated as null-terminated, but an attacker can fill all 48 wide characters with non-zero values and append additional data beyond the structure boundary. Since the handler only validates minimum packet size rather than maximum, wcscat reads past the intended 48-character limit and writes attacker-controlled data beyond the 160-character stack buffer. This is a classic CWE-121 stack-based buffer overflow, representing a critical flaw in a security boundary enforcement component.