{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34458 exists.","fix":"No fix has been published for CVE-2026-34458 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-34458 is a critical vulnerability in sandboxie-plus Sandboxie, published on 5 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-34458 and fix it if it is affected.\n\nWhat it is: CVE-2026-34458 is a critical vulnerability in sandboxie-plus Sandboxie, published on 5 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34458 exists.\n\nAffected product: sandboxie-plus Sandboxie. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-34458/ (Markdown: https://insights.sbomify.com/CVE-2026-34458/index.md)","id":"CVE-2026-34458","markdown":"https://insights.sbomify.com/CVE-2026-34458/index.md","name":"CVE-2026-34458","record":{"aliases":["GHSA-6xqg-2cjq-95qf"],"analysis":{"component_type":"operating_system","fix_type":"upgrade","impacts":["privilege_escalation","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Windows sandbox software","requires_auth":"low_privilege","summary":"Local attackers can inject CRLF characters into INI settings to bypass admin restrictions, enabling sandbox escape and SYSTEM privilege escalation.","user_interaction":"not_required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"sandboxie","vendor":"sandboxie-plus"}],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-93","name":"Improper Neutralization of CRLF Sequences"}],"description":"Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly","id":"CVE-2026-34458","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"privilege_escalation","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave","id":"CVE-2026-34459"},"packages":[],"prev":{"headline":"OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode","id":"CVE-2026-34457"},"products":["Sandboxie"],"published":"2026-05-05","related":[{"cvss_score":10,"headline":"Security feature bypass in n/a","id":"CVE-2018-18748","kev_date_added":null,"published":"2018-10-28"},{"cvss_score":9.9,"headline":"Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise","id":"CVE-2025-64721","kev_date_added":null,"published":"2025-12-11"},{"cvss_score":9.2,"headline":"Path traversal in Sandboxie","id":"CVE-2024-49360","kev_date_added":null,"published":"2024-11-29"},{"cvss_score":8.8,"headline":"Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave","id":"CVE-2026-34459","kev_date_added":null,"published":"2026-05-05"},{"cvss_score":8.8,"headline":"Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field","id":"CVE-2026-34464","kev_date_added":null,"published":"2026-05-05"},{"cvss_score":8.2,"headline":"Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process","id":"CVE-2026-32603","kev_date_added":null,"published":"2026-05-05"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-05-07","vendors":["sandboxie-plus"]},"summary":"Local attackers can inject CRLF characters into INI settings to bypass admin restrictions, enabling sandbox escape and SYSTEM privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-34458/"}