Sandboxie-Plus
CVE-2026-45313
HIGH
Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attacker must already run code inside a sandbox (AV:L, PR:L); reaching the hook-notify path needs specific timing (AC:H); escape to SYSTEM host crosses trust boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread belongs to the sandboxed process or that the function pointer is in the caller address space, and GuiServer::WndHookNotifySlave then calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, (ULONG_PTR)req->threadid) as SYSTEM, allowing a sandboxed process to execute arbitrary code in an unsandboxed host process. This issue is fixed in version 1.17.6.
AnalysisAI
Sandbox escape with SYSTEM-level code execution in Sandboxie-Plus before 1.17.6 allows a process confined inside a sandbox to run arbitrary code in an unsandboxed host process. The privileged GuiServer service trusts attacker-supplied thread and function-pointer values from a GUI window-hook registration request and dispatches them via QueueUserAPC while running as SYSTEM, defeating the core isolation guarantee of the product. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the mechanism is a full sandbox-to-host escape.
Technical ContextAI
Sandboxie-Plus is an open-source Windows application-isolation tool whose SYSTEM-level GuiServer brokers GUI operations for sandboxed processes over an RPC-style request channel. The defect (CWE-284, Improper Access Control) lives in Sandboxie/core/svc/GuiServer.cpp: GuiServer::WndHookRegisterSlave stores the hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread handle belongs to the sandboxed caller or that the hproc function pointer resides in the caller's address space. Later, GuiServer::WndHookNotifySlave calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, ...) in the SYSTEM context, so the attacker-chosen pointer is scheduled as an asynchronous procedure call against an attacker-influenced thread - a classic missing-authorization / confused-deputy pattern turned into arbitrary code execution outside the sandbox boundary.
RemediationAI
Vendor-released patch: 1.17.6 (classic 5.72.6) - upgrade all installations to this version or later, per advisory GHSA-rmv3-fhg3-75xh and the release at https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.6, which adds the missing validation of the hthread/hproc fields in GuiServer's window-hook handling. The release notes confirm 'a problem affecting hook registration has been fixed.' No vendor-documented configuration workaround is provided; if immediate patching is not possible, compensating controls are to avoid running untrusted or high-risk code inside Sandboxie boxes and to restrict who can launch sandboxed processes on the host, accepting that this reduces the tool's intended use of confining untrusted software. Disabling GUI window-hooking features for sandboxes, where the configuration allows, would cut off the vulnerable code path but may break applications that legitimately rely on hooks. Because the escape yields SYSTEM execution, treat any potentially-compromised host as needing full re-imaging rather than in-place cleanup.
Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershe
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Rated high sev
Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supply
INI injection in Sandboxie-Plus versions 1.17.2 and earlier enables any local low-privilege user to bypass EditAdminOnly
Stack-based buffer overflow in Sandboxie-Plus SbieSvc service enables sandboxed processes to escape isolation and execut
Stack buffer overflow in Sandboxie-Plus SbieSvc proxy service enables SYSTEM privilege escalation from sandboxed process
An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in t
Local denial of service in Sandboxie 1.17.2 and earlier allows unprivileged processes inside Standard Sandbox configurat
Stack-based buffer overflow in Sandboxie-Plus ProcessServer handlers allows local authenticated attackers to execute arb
Local privilege escalation to SYSTEM in Sandboxie-Plus 1.17.2 and earlier allows low-privileged interactive users to tri
Sandboxie-Plus versions 1.17.2 and earlier are vulnerable to privilege escalation via a Time-of-Check-to-Time-of-Use (TO
Sandboxie-Plus versions 1.17.2 and earlier contain a cryptographic implementation flaw in SbieIniServer::HashPassword th
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today