CVE-2026-34462
Buffer Overflow in Sandboxie-Plus ProcessServer Handlers
Publication date: 2026-05-05
Last updated on: 2026-05-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sandboxie-plus | sandboxie-plus | to 1.17.3 (exc) |
| sandboxie-plus | sandboxie | to 1.17.3 (exc) |
| sandboxie-plus | sandboxie | 1.17.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-170 | The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-34462 is a high-severity stack-based buffer overflow vulnerability in Sandboxie-Plus, an open source sandboxing software for Windows. The issue occurs in the ProcessServer component, specifically in handlers like KillAllHandler, SuspendAllHandler, and RunSandboxedHandler. These handlers copy a fixed-length WCHAR boxname field from request structures into larger stack buffers using wcscpy without verifying null termination.
Because the service pipe accepts variable-length packets larger than the request structure, an attacker can send a specially crafted packet that fills the boxname field with non-terminated data and appends additional controlled wide characters. This causes wcscpy to read beyond the intended buffer and overflow the destination stack buffer.
The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy happens before authorization checks. This can lead to a crash of the SbieSvc service or potentially allow code execution with SYSTEM privileges.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including causing the Sandboxie-Plus service (SbieSvc) to crash, leading to denial of service.
More critically, it can allow a local attacker to execute arbitrary code with SYSTEM privileges, effectively escalating their privileges from an unprivileged local process to full system control.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a stack-based buffer overflow in the Sandboxie-Plus ProcessServer handlers that accept variable-length packets on a service pipe with a NULL DACL, allowing any local process to connect. Detection would involve monitoring or inspecting local process interactions with the SbieSvc service pipe for abnormal or oversized packets targeting the boxname field.
Since the vulnerability is local and involves specific handlers (KillAllHandler, SuspendAllHandler, RunSandboxedHandler) processing crafted requests, detection commands could include checking for unusual or crashing behavior of the SbieSvc service or monitoring local IPC (inter-process communication) traffic to the Sandboxie-Plus service pipe.
However, no specific detection commands or network signatures are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed in Sandboxie-Plus version 1.17.3. The immediate mitigation step is to upgrade Sandboxie-Plus to version 1.17.3 or later.
Additional mitigation involves restricting local access to the SbieSvc service pipe to prevent untrusted local processes from connecting, as the service pipe is created with a NULL DACL allowing any local process to connect.
Until the update is applied, monitoring for crashes or suspicious activity related to the SbieSvc service may help identify exploitation attempts.