Skip to content
Heist/ feed
Back to feed
High

Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation

Type: advisorySources: OSV

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-34461
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 16:07 UTC · Revision 1

Source evidence

Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation

core-osv · Original source

Published 5 May 2026, 19:28 UTC

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

osv:CVE-2026-34461
Complete source record
{
  "id": "16dec7e693b63a58459799bceb81c7bd2b0d29d12335ec59886b7067ef6b93f4",
  "url": "https://osv.dev/vulnerability/CVE-2026-34461",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation",
    "summary": "Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.",
    "evidence": "osv:CVE-2026-34461",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-34461",
      "aliases": [
        "CVE-2026-34461",
        "GHSA-wpjw-jh2p-gwx7"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/sandboxie-plus/sandboxie",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4f0dbecdcc10063ad1fa7c8f1080419613921f4a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.17.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.17.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.17.2",
            "v1.17.1",
            "v1.17.0",
            "v1.16.9",
            "v1.16.8",
            "v1.16.7",
            "v1.16.6",
            "v1.16.4",
            "v1.16.3",
            "v1.16.2",
            "v1.16.1",
            "v1.16.0",
            "v1.15.12",
            "v1.15.10",
            "v1.15.9",
            "v1.15.8",
            "v1.15.7",
            "v1.15.6",
            "v1.15.5",
            "v1.15.4",
            "v1.15.3",
            "v1.15.2",
            "v1.15.1",
            "v1.15.0",
            "v1.14.10",
            "v1.14.9",
            "v1.14.8",
            "v1.14.7",
            "v1.14.6",
            "v1.14.5",
            "v1.14.4",
            "v1.14.3",
            "v1.14.1",
            "v1.14.0",
            "v1.13.7",
            "v1.13.6",
            "v1.13.5",
            "v1.13.4",
            "v1.13.3",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v1.12.9",
            "v1.12.8",
            "v1.12.7",
            "v1.12.6",
            "v1.12.5",
            "v1.12.4",
            "v1.12.3",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v1.11.4",
            "v1.11.3",
            "v1.11.2",
            "v1.11.1",
            "v1.11.0",
            "v1.10.5",
            "v1.10.4",
            "v1.10.3",
            "v1.10.2",
            "v1.10.1",
            "v1.9.8",
            "v1.9.7",
            "v1.9.6",
            "v1.9.4",
            "v1.9.3",
            "v1.9.1",
            "v1.9.0",
            "v1.8.4",
            "v1.8.3",
            "v1.8.2a",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.6.7",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2b",
            "v1.6.1b",
            "v1.6.1a",
            "v1.6.1",
            "v1.6.0",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.5",
            "1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.9",
            "v1.2.8",
            "v1.2.7",
            "v1.2.6",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.1.3",
            "v1.1.2",
            "1.1.0",
            "1.0.22",
            "1.0.20",
            "1.0.19",
            "1.0.18",
            "1.0.17",
            "1.0.16",
            "1.0.15",
            "1.0.14",
            "1.0.13",
            "1.0.12",
            "1.0.11",
            "1.0.10",
            "1.0.8",
            "1.0.6",
            "1.0.5",
            "1.0.4",
            "1.0.3",
            "1.0.2",
            "1.0.1",
            "1.0.0",
            "0.9.8d",
            "0.9.8c",
            "0.9.8",
            "0.9.7e",
            "0.9.7d",
            "0.9.7c",
            "0.9.7b",
            "0.9.7",
            "0.9.6",
            "0.9.5",
            "0.9.4",
            "0.9.3",
            "0.9.2",
            "0.9.1",
            "0.9.0a",
            "0.8.8",
            "0.8.7b",
            "0.8.7",
            "0.8.6",
            "0.8.5",
            "0.8.2",
            "0.8.0",
            "0.8.1",
            "0.7.5",
            "0.7.4",
            "0.7.3",
            "0.7.2",
            "0.7.1",
            "0.7.0",
            "0.6.7",
            "0.6.5",
            "0.6.0",
            "0.5.5",
            "v0.5.4d",
            "v0.5.4c",
            "v0.5.4b",
            "v0.5.4",
            "v0.5.3b",
            "v0.5.3a",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.5",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.5",
            "v0.3",
            "v0.2.2",
            "v0.2.1",
            "v0.2",
            "v0.1",
            "v5.40.1",
            "v5.40"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34461.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.231797900Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34461.json",
        "https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-wpjw-jh2p-gwx7",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-34461"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-121"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34461.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-34461",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 519828,
  "published_at": "2026-05-05T19:28:44.675+00:00"
}