CVE-2026-34527: CWE-328: Use of Weak Hash in sandboxie-plus Sandboxie
Sandboxie-Plus versions 1. 17. 2 and earlier contain a weakness in the password hashing implementation where the SHA-1 digest is incorrectly converted to hexadecimal, reducing the effective entropy of stored password hashes from 160 bits to 80 bits. This is due to a coding error that shifts the high nibble incorrectly and the use of an unsalted SHA-1 hash. The issue has been fixed in version 1. 17. 3. The vulnerability has a low severity score and no known exploits in the wild.
AI Analysis
Technical Summary
Sandboxie-Plus, an open source sandbox isolation software for Windows, in versions prior to 1.17.3, improperly converts SHA-1 password digests to hexadecimal by shifting the high nibble right by 8 bits instead of 4, resulting in zeroing out the high nibble. This reduces the stored EditPassword hash entropy from 160 bits to 80 bits. Additionally, the hashing scheme uses unsalted SHA-1, further weakening password hash security. This vulnerability is identified as CWE-328 (Use of Weak Hash). The issue was addressed and fixed in version 1.17.3.
Potential Impact
The incorrect hexadecimal conversion and use of unsalted SHA-1 reduce the effective entropy of password hashes, making leaked or backed-up password hashes easier to brute-force. However, the overall severity is low (CVSS 2.0) due to the local attack vector, high attack complexity, and limited privileges required. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade Sandboxie-Plus to version 1.17.3 or later, where this hashing issue has been fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor stating the fix in version 1.17.3.
CVE-2026-34527: CWE-328: Use of Weak Hash in sandboxie-plus Sandboxie
Description
Sandboxie-Plus versions 1. 17. 2 and earlier contain a weakness in the password hashing implementation where the SHA-1 digest is incorrectly converted to hexadecimal, reducing the effective entropy of stored password hashes from 160 bits to 80 bits. This is due to a coding error that shifts the high nibble incorrectly and the use of an unsalted SHA-1 hash. The issue has been fixed in version 1. 17. 3. The vulnerability has a low severity score and no known exploits in the wild.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Sandboxie-Plus, an open source sandbox isolation software for Windows, in versions prior to 1.17.3, improperly converts SHA-1 password digests to hexadecimal by shifting the high nibble right by 8 bits instead of 4, resulting in zeroing out the high nibble. This reduces the stored EditPassword hash entropy from 160 bits to 80 bits. Additionally, the hashing scheme uses unsalted SHA-1, further weakening password hash security. This vulnerability is identified as CWE-328 (Use of Weak Hash). The issue was addressed and fixed in version 1.17.3.
Potential Impact
The incorrect hexadecimal conversion and use of unsalted SHA-1 reduce the effective entropy of password hashes, making leaked or backed-up password hashes easier to brute-force. However, the overall severity is low (CVSS 2.0) due to the local attack vector, high attack complexity, and limited privileges required. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade Sandboxie-Plus to version 1.17.3 or later, where this hashing issue has been fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor stating the fix in version 1.17.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-30T16:03:31.048Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fa4dc2cbff5d86102152ac
Added to database: 5/5/2026, 8:06:26 PM
Last enriched: 5/5/2026, 8:22:02 PM
Last updated: 5/5/2026, 9:07:13 PM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.