CVE-2026-45313 Sandboxie-Plus: Sandboxie APC Injection Sandbox Escape
A sandboxed process can execute arbitrary code in an unsandboxed host process with SYSTEM privileges due to insufficient validation of APC injection parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-45313?
CVE-2026-45313 is a high-severity vulnerability in sandboxie-plus Sandboxie, published on 15 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread belongs to the sandboxed process or that the function pointer is in the caller address space, and GuiServer::WndHookNotifySlave then calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, (ULONG_PTR)req->threadid) as SYSTEM, allowing a sandboxed process to execute arbitrary code in an unsandboxed host process. This issue is fixed in version 1.17.6.
Weakness: CWE-284
Which versions are affected by CVE-2026-45313?
How do I fix CVE-2026-45313?
No fix has been published for CVE-2026-45313 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45313 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45313 exists.
Sources
Also known as GHSA-rmv3-fhg3-75xh.