PT-2026-37225 · Unknown · Sandboxie Plus

Sammy12342 · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-34458

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Sandboxie-Plus versions prior to 1.17.3

Description An INI injection issue allows a standard local user to bypass configuration restrictions, specifically EditAdminOnly and ConfigPassword, to inject arbitrary directives into the global Sandboxie.ini configuration file. The background service fails to perform authorization checks for IPC (Inter-Process Communication) messages targeting sections starting with UserSettings and does not sanitize CRLF (Carriage Return Line Feed) characters in the value parameter via MSGID SBIE INI ADD SETTING or the setting name parameter via MSGID SBIE INI SET SETTING. This allows an attacker to inject a new sandbox section header with unrestricted permissions, leading to sandbox escape and SYSTEM privilege escalation.

Recommendations Update to version 1.17.3.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-34458

Affected Products

Sandboxie Plus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34458 · Security Note
• https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3 · Note
• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-6xqg-2cjq-95qf · Note
• https://twitter.com/CVEnew/status/2051758512800158029 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051760452934238591 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051805637600743449 · Twitter Post