CVE-2026-34596 Details
Description
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface, UpdUtil.exe is spawned as SYSTEM by SbieSvc but stages files in the user-writable %TEMP%\sandboxie-updater directory. After UpdUtil verifies file hashes against the signed addon manifest, install.bat extracts files.cab and executes config.exe from its contents. Between hash verification and extraction, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM. No UAC prompt is required. This issue has been fixed in version 1.17.3.
A local privilege escalation vulnerability has been identified in Sandboxie-Plus versions through 1.17.2. The issue arises from a Time-of-Check-to-Time-of-Use (TOCTOU) race condition during the installation of addons. When an addon is installed via the SandMan interface, UpdUtil.exe is executed with SYSTEM privileges by the SbieSvc service. However, UpdUtil stages files in a user-writable temporary directory. After verifying the integrity of the downloaded files against the signed addon manifest, UpdUtil extracts and executes a configuration file from the addon. This process creates a window of opportunity for an unprivileged user to replace the legitimate addon file with a malicious one, which is then executed with SYSTEM rights, bypassing any User Account Control prompts.
Users can update to Sandboxie-Plus version 1.17.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-xjvp-63f2-v585 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-xjvp-63f2-v585 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sandboxie-plus sandboxie | < 1.17.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |