CVE-2026-34459— Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave

Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request with cbSize set to 0, up to 32KB of uninitialized stack memory from the service process is returned, leaking return addresses and stack cookies which bypass ASLR and /GS protections. Second, the handler performs a memcpy with an attacker-controlled length without verifying it fits within the 32KB stack buffer, enabling a stack buffer overflow. By chaining the information leak with the overflow, a sandboxed process can execute a ROP chain to achieve SYSTEM privilege escalation, even from a Security Hardened Sandbox. Hardware-enforced shadow stacks (Intel CET) prevent the ROP chain execution but do not mitigate the information leak. This issue has been fixed in version 1.17.3.

N/A

栈缓冲区溢出

Sandboxie-Plus 安全漏洞

Sandboxie-Plus是Sandboxie-Plus公司的一款沙盒隔离软件。 Sandboxie-Plus 1.17.2及之前版本存在安全漏洞，该漏洞源于SbieSvc代理服务的GetRawInputDeviceInfoSlave处理程序存在信息泄露和栈缓冲区溢出，可能导致沙箱逃逸和SYSTEM权限提升。

N/A

N/A