CVE-2026-102280: falha de média gravidade em sandboxie-plus Sandboxie
Sandboxie-Plus: Sandbox containment bypass
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.1%
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
sandboxie-plus · SandboxieCVEs relacionadas — sandboxie-plus Sandboxie
No mesmo produto, das mais perigosas para as menos.
CVE-2025-64721CRITICALSandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromiseEPSS 0.7%CVE-2024-49360CRITICALPath traversal in SandboxieEPSS 0.5%CVE-2026-34458CRITICALSandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnlyEPSS 0.3%CVE-2025-46714HIGHSandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_GET_SECURE_PARAM)EPSS 0.2%CVE-2025-46715HIGHSandboxie Arbitrary Kernel Write in SbieDrv.sys API (API_GET_SECURE_PARAM)EPSS 0.2%CVE-2025-46713HIGHSandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_SET_SECURE_PARAM)EPSS 0.2%