PT-2026-37230 · Unknown · Sandboxie Plus

Yanchon918S · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-34527

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sandboxie-Plus versions prior to 1.17.3

Description The SbieIniServer::HashPassword() function incorrectly converts a SHA-1 digest to hexadecimal by shifting the high nibble of each byte right by 8 instead of 4. This process results in the high nibble always being zero for an 8-bit value, meaning the stored EditPassword hash only preserves the low nibble of each digest byte. Consequently, the effective entropy is reduced from 160 bits to 80 bits. This flaw, combined with an unsalted SHA-1 scheme, makes leaked or backed-up password hashes significantly easier to brute-force.

Recommendations Update to version 1.17.3.

Fix

Weakness Enumeration

CWE-328

Related Identifiers

CVE-2026-34527

Affected Products

Sandboxie Plus

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-34527 · Security Note
• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w37h-qm9p-h4x2 · Note
• https://twitter.com/CVEnew/status/2051758507582464370 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051792838740877379 · Twitter Post