CVE-2026-34459 Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave
A sandboxed process can escape isolation and gain SYSTEM privileges by chaining an information leak with a stack buffer overflow in the service handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34459?
CVE-2026-34459 is a high-severity memory corruption vulnerability in sandboxie-plus Sandboxie, published on 5 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request with cbSize set to 0, up to 32KB of uninitialized stack memory from the service process is returned, leaking return addresses and stack cookies which bypass ASLR and /GS protections. Second, the handler performs a memcpy with an attacker-controlled length without verifying it fits within the 32KB stack buffer, enabling a stack buffer overflow. By chaining the information leak with the overflow, a sandboxed process can execute a ROP chain to achieve SYSTEM privilege escalation, even from a Security Hardened Sandbox. Hardware-enforced shadow stacks (Intel CET) prevent the ROP chain execution but do not mitigate the information leak. This issue has been fixed in version 1.17.3.
Weakness: CWE-121
Which versions are affected by CVE-2026-34459?
It affects 1 product.
Products include Sandboxie-Plus Sandboxie.
How do I fix CVE-2026-34459?
No fix has been published for CVE-2026-34459 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-34459 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34459 exists.
Other vulnerabilities in sandboxie-plus Sandboxie
- CVE-2018-18748 Security feature bypass in n/a
- CVE-2025-64721 Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise
- CVE-2026-34458 Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly
- CVE-2024-49360 Path traversal in Sandboxie
- CVE-2026-34464 Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field
Sources
Also known as GHSA-7cpc-5hv7-rfmh.