Compliance Impact

The provided information does not specify how this vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-34596 is a local privilege escalation vulnerability in Sandboxie-Plus versions 1.17.2 and earlier. It arises from a Time-of-Check-to-Time-of-Use (TOCTOU) race condition during addon installation.

When a user installs an addon via the SandMan interface, a process called UpdUtil.exe is launched with SYSTEM privileges but stages files in a user-writable temporary directory (%TEMP%\sandboxie-updater). After verifying file hashes against the signed addon manifest, UpdUtil.exe extracts and executes files from a cabinet file (files.cab).

Between the hash verification and extraction steps, an unprivileged user can replace the legitimate files.cab with a malicious cabinet containing a harmful executable. This malicious executable is then run with SYSTEM privileges without triggering any User Account Control (UAC) prompt.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unprivileged local attacker to escalate their privileges to SYSTEM level on a Windows machine running vulnerable versions of Sandboxie-Plus.

By exploiting the race condition, an attacker can execute arbitrary code with full administrative rights without any user consent or UAC prompt.

This can lead to complete system compromise, unauthorized access to sensitive data, installation of persistent malware, and the ability to bypass security controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the presence and activity of the UpdUtil.exe process spawned by SbieSvc during addon installation in Sandboxie-Plus versions 1.17.2 and earlier.

Specifically, detection involves checking if UpdUtil.exe is running with SYSTEM privileges and if it is staging files in the user-writable %TEMP%\sandboxie-updater directory.

Commands to help detect this include:

• Using PowerShell to check for UpdUtil.exe processes: Get-Process -Name UpdUtil
• Checking the permissions and ownership of the %TEMP%\sandboxie-updater directory to see if it is user-writable and accessible by unprivileged users.
• Monitoring file changes or replacements in the %TEMP%\sandboxie-updater directory, especially for files.cab.
• Reviewing logs or using auditing tools to detect if config.exe or other executables are launched from the staging directory with SYSTEM privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Sandboxie-Plus to version 1.17.3 or later, where this vulnerability has been fixed.

Until the upgrade can be applied, restrict addon installation to administrative users only to prevent unprivileged users from exploiting the TOCTOU race condition.

Additionally, ensure that the staging directory (%TEMP%\sandboxie-updater) is owned by SYSTEM and has strict permissions to prevent unprivileged users from modifying files there.

Re-verifying file hashes before extraction and execution can also help mitigate the risk.

Finally, consider stopping the SbieSvc service if addon installation is not required, to prevent UpdUtil.exe from being spawned.

Useful 0 Not Useful 0