Executive Summary

CVE-2026-34462 is a high-severity stack-based buffer overflow vulnerability in Sandboxie-Plus, an open source sandboxing software for Windows. The issue occurs in the ProcessServer component, specifically in handlers like KillAllHandler, SuspendAllHandler, and RunSandboxedHandler. These handlers copy a fixed-length WCHAR boxname field from request structures into larger stack buffers using wcscpy without verifying null termination.

Because the service pipe accepts variable-length packets larger than the request structure, an attacker can send a specially crafted packet that fills the boxname field with non-terminated data and appends additional controlled wide characters. This causes wcscpy to read beyond the intended buffer and overflow the destination stack buffer.

The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy happens before authorization checks. This can lead to a crash of the SbieSvc service or potentially allow code execution with SYSTEM privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including causing the Sandboxie-Plus service (SbieSvc) to crash, leading to denial of service.

More critically, it can allow a local attacker to execute arbitrary code with SYSTEM privileges, effectively escalating their privileges from an unprivileged local process to full system control.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stack-based buffer overflow in the Sandboxie-Plus ProcessServer handlers that accept variable-length packets on a service pipe with a NULL DACL, allowing any local process to connect. Detection would involve monitoring or inspecting local process interactions with the SbieSvc service pipe for abnormal or oversized packets targeting the boxname field.

Since the vulnerability is local and involves specific handlers (KillAllHandler, SuspendAllHandler, RunSandboxedHandler) processing crafted requests, detection commands could include checking for unusual or crashing behavior of the SbieSvc service or monitoring local IPC (inter-process communication) traffic to the Sandboxie-Plus service pipe.

However, no specific detection commands or network signatures are provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in Sandboxie-Plus version 1.17.3. The immediate mitigation step is to upgrade Sandboxie-Plus to version 1.17.3 or later.

Additional mitigation involves restricting local access to the SbieSvc service pipe to prevent untrusted local processes from connecting, as the service pipe is created with a NULL DACL allowing any local process to connect.

Until the update is applied, monitoring for crashes or suspicious activity related to the SbieSvc service may help identify exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0