Sandboxie-Plus CVE-2026-34527

The vulnerability requires that an attacker first obtain access to the stored EditPassword hash, which is persisted in Sandboxie-Plus configuration files or Windows registry on the local system. The attack is offline and asynchronous - no real-time interaction with Sandboxie-Plus is required after hash extraction. Exploitation is limited to local scenarios where the attacker can read configuration files or registry, which typically requires either local file system access (e.g., via backup, USB theft, or physical access) or an existing local account with permission to read Sandboxie configuration. The EditPassword feature must be in use (if no EditPassword is configured, there is no hash to attack). The vulnerability does not enable remote code execution or remote authentication bypass; it strictly weakens the difficulty of offline password recovery from a cryptographic perspective. Default Sandboxie-Plus installations may not have EditPassword configured, limiting exposure in basic use cases.

The CVSS 2.0 score (AV:L/AC:H/AT:P/PR:L) reflects the local attack vector and requirement for low-privileged authentication, limiting the immediate exposure surface. However, the risk assessment is substantially nuanced by exploitation conditions: the vulnerability only threatens password hashes that have been leaked, backed up, or otherwise obtained offline - attackers cannot directly exploit this to authenticate without first gaining access to the stored hash file. The CVSS does not capture the cryptographic severity (80-bit entropy is practically breakable with modern hardware), nor the fact that an offline attack requires no further interaction with the system. The AC:H (High Complexity) rating appears inconsistent with the straightforward nature of a brute-force attack against a weakened hash; this may reflect the requirement to first obtain the hash file. Real-world risk depends entirely on deployment model: Sandboxie-Plus is typically installed by administrators on individual Windows systems, so exposure is limited to scenarios where an attacker has already obtained local file access. If used in shared or multi-user environments, or if password hashes are backed up to less-secure locations, risk escalates significantly. The low CVSS does not reflect the cryptographic weakness magnitude.

An attacker with local access to a Windows system running Sandboxie-Plus 1.17.2 extracts the stored EditPassword hash from the configuration or registry. Using standard offline brute-force tools (hashcat, John the Ripper) and leveraging the reduced 80-bit entropy, the attacker generates candidates at a rate significantly faster than against a full 160-bit SHA-1 hash. Within hours to days depending on hardware and dictionary size, the plaintext password is recovered, allowing the attacker to gain administrative control over the sandbox isolation settings and potentially bypass security boundaries.