CVE-2026-34461: CWE-121: Stack-based Buffer Overflow in sandboxie-plus Sandboxie
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.
AI Analysis
Technical Summary
Sandboxie-Plus, an open source sandbox isolation tool for Windows, contains a stack buffer overflow in the SbieIniServer RunSbieCtrl handler in versions prior to 1.17.3. The vulnerability arises because the handler copies message payload data into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without validating the payload length. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload, leading to a stack overflow. This can result in a crash of the SbieSvc service or potential arbitrary code execution with SYSTEM privileges. The issue is addressed in version 1.17.3.
Potential Impact
Exploitation of this vulnerability can cause the Sandboxie service to crash or allow an attacker with local interactive access to execute code with SYSTEM privileges. This elevates the attacker's privileges on the affected system, posing a significant security risk.
Mitigation Recommendations
This vulnerability is fixed in Sandboxie-Plus version 1.17.3. Users should upgrade to version 1.17.3 or later to remediate this issue. Since the vendor advisory confirms the fix in 1.17.3, applying this update is the recommended mitigation.
CVE-2026-34461: CWE-121: Stack-based Buffer Overflow in sandboxie-plus Sandboxie
Description
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.
CVSS v4.0
Score 7.3high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Sandboxie-Plus, an open source sandbox isolation tool for Windows, contains a stack buffer overflow in the SbieIniServer RunSbieCtrl handler in versions prior to 1.17.3. The vulnerability arises because the handler copies message payload data into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without validating the payload length. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload, leading to a stack overflow. This can result in a crash of the SbieSvc service or potential arbitrary code execution with SYSTEM privileges. The issue is addressed in version 1.17.3.
Potential Impact
Exploitation of this vulnerability can cause the Sandboxie service to crash or allow an attacker with local interactive access to execute code with SYSTEM privileges. This elevates the attacker's privileges on the affected system, posing a significant security risk.
Mitigation Recommendations
This vulnerability is fixed in Sandboxie-Plus version 1.17.3. Users should upgrade to version 1.17.3 or later to remediate this issue. Since the vendor advisory confirms the fix in 1.17.3, applying this update is the recommended mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-27T18:18:14.896Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fa4dc2cbff5d86102152a3
Added to database: 5/5/2026, 8:06:26 PM
Last enriched: 5/13/2026, 3:39:16 AM
Last updated: 6/20/2026, 8:39:54 AM
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.