PT-2026-37229 · Unknown · Sandboxie Plus

Yanchon918S · Published 2026-05-05 · Updated 2026-05-07 · CVE-2026-34464

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sandboxie-Plus versions prior to 1.17.3

Description An issue exists in the NamedPipeServer::OpenHandler function where the server field from NAMED PIPE OPEN REQ is copied into a fixed WCHAR pipename[160] stack buffer using wcscat without verifying null termination. Because the service pipe accepts variable-length messages and only enforces a minimum packet size, a sandboxed caller can fill the server[48] field with non-zero data and append controlled wide characters. This causes wcscat to read past the fixed field and overflow the stack buffer in the SYSTEM service, creating a sandbox escape vector. This may result in a crash of the SbieSvc service or potential code execution with SYSTEM privileges.

Recommendations Update to version 1.17.3.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

CWE-170

Related Identifiers

CVE-2026-34464

Affected Products

Sandboxie Plus

References · 5

• 🔥 https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-cf8x-f33g-vwfg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34464 · Security Note
• https://t.me/cveNotify/162520 · Telegram Post
• https://t.me/CVEtracker/52780 · Telegram Post
• https://twitter.com/CVEnew/status/2051758508534575598 · Twitter Post