PT-2026-37226 · Unknown · Sandboxie Plus

Sammy12342 · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-34459

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Sandboxie-Plus versions prior to 1.17.3

Description The SbieSvc proxy service's GetRawInputDeviceInfoSlave() handler contains an information leak and a stack buffer overflow. An information leak occurs when a sandboxed process sends an IPC request with cbSize set to 0, causing up to 32KB of uninitialized stack memory to be returned. This leaks return addresses and stack cookies, bypassing Address Space Layout Randomization (ASLR) and /GS protections. Additionally, the handler performs a memcpy operation using an attacker-controlled length without verifying if it fits within the 32KB stack buffer. By chaining these issues, a sandboxed process can execute a Return-Oriented Programming (ROP) chain—a technique that strings together small pieces of existing executable code—to achieve SYSTEM privilege escalation, even from a Security Hardened Sandbox. Hardware-enforced shadow stacks (Intel CET) prevent the ROP chain execution but do not stop the information leak.

Recommendations Update to version 1.17.3.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-34459

Affected Products

Sandboxie Plus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34459 · Security Note
• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-7cpc-5hv7-rfmh · Note
• https://twitter.com/infoflowcloud/status/2051760436752593319 · Twitter Post
• https://twitter.com/CVEnew/status/2051758511457968594 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051803077980659714 · Twitter Post