CVE-2026-32603

Katalog CVE

CVSS 6.5 · Medium EPSS 0,16%

Kerentanan Improper Input Validation pada sandboxie-plus sandboxie. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the Sandboxie kernel driver. An unprivileged process running inside a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriverApi driver, triggering an immediate kernel crash (BSOD). The vulnerability affects the Standard Sandbox configuration both with and without dropped administrator privileges, but does not affect the Security Hardened Sandbox configuration. This issue has been fixed in version 1.17.3. Users who cannot update can use the Security Hardened Sandbox configuration as a workaround.

Rincian

Terbit di NVD

5 Mei 2026

Terakhir diubah

25 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vvf8-cf4j-v8fv exploit · advisory vendor
• https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3 release notes