PT-2026-37229 · Unknown · Sandboxie Plus

Yanchon918S · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-34464

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Sandboxie-Plus versions prior to 1.17.3

Description An issue exists in the NamedPipeServer::OpenHandler function where the server field from NAMED PIPE OPEN REQ is copied into a fixed WCHAR pipename[160] stack buffer using wcscat without verifying null termination. Because the service pipe accepts variable-length messages and only enforces a minimum packet size, a sandboxed caller can fill the server[48] field with non-zero data and append controlled wide characters. This causes wcscat to read past the fixed field and overflow the stack buffer in the SYSTEM service, creating a sandbox escape vector. This may result in a crash of the SbieSvc service or potential code execution with SYSTEM privileges.

Recommendations Update to version 1.17.3.

Fix

Stack Overflow

Weakness Enumeration

CWE-170

CWE-121

Related Identifiers

CVE-2026-34464

Affected Products

Sandboxie Plus

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-34464 · Security Note
• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-cf8x-f33g-vwfg · Note
• https://twitter.com/CVEnew/status/2051758508534575598 · Twitter Post