Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-34458

Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Sandboxie-plus
Products
Sandboxie
CVE-2026-34459

Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request with cbSize set to 0, up to 32KB of uninitialized stack memory from the service process is returned, leaking return addresses and stack cookies which bypass ASLR and /GS protections. Second, the handler performs a memcpy with an attacker-controlled length without verifying it fits within the 32KB stack buffer, enabling a stack buffer overflow. By chaining the information leak with the overflow, a sandboxed process can execute a ROP chain to achieve SYSTEM privilege escalation, even from a Security Hardened Sandbox. Hardware-enforced shadow stacks (Intel CET) prevent the ROP chain execution but do not mitigate the information leak. This issue has been fixed in version 1.17.3.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sandboxie-plus
Products
Sandboxie
CVE-2026-34461

Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Sandboxie-plus
Products
Sandboxie
CVE-2026-34462

Sandboxie-Plus ProcessServer boxname stack buffer overflows via unterminated wide string copy

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from request structures into WCHAR[40] stack buffers using wcscpy without verifying null termination. Because the service pipe accepts variable-length packets larger than the request structure, an attacker can fill the boxname field with non-zero data and append additional controlled wide characters after the structure. wcscpy then reads past the fixed field and overflows the destination stack buffer. The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy occurs before authorization checks. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Sandboxie-plus
Products
Sandboxie
CVE-2026-34464

Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server field from NAMED_PIPE_OPEN_REQ into a fixed WCHAR pipename[160] stack buffer using wcscat without verifying null termination. The handler only enforces a minimum packet size, and since the service pipe accepts variable-length messages, a sandboxed caller can fill the server[48] field with non-zero data and append additional controlled wide characters after the structure. wcscat then reads past the fixed field and overflows the stack buffer in the SYSTEM service. This message is restricted to sandboxed callers, making it a sandbox escape vector. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sandboxie-plus
Products
Sandboxie
CVE-2026-41642

GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPDATE message contains an unrecognized Path Attribute marked as "Well-known," the daemon fails to interrupt the message handling flow. This results in an illegal memory access and a full process crash (panic). This issue has been patched in version 4.4.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Osrg
Products
Gobgp
CVE-2026-34596

Sandboxie-Plus local privilege escalation via TOCTOU race condition in UpdUtil addon installation

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface, UpdUtil.exe is spawned as SYSTEM by SbieSvc but stages files in the user-writable %TEMP%\sandboxie-updater directory. After UpdUtil verifies file hashes against the signed addon manifest, install.bat extracts files.cab and executes config.exe from its contents. Between hash verification and extraction, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM. No UAC prompt is required. This issue has been fixed in version 1.17.3.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sandboxie-plus
Products
Sandboxie
CVE-2026-41643

GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a runtime error: index out of range panic. This occurs during the processing of 4-byte AS attributes when the message structure causes an internal slice index shift that is not properly handled. This issue has been patched in version 4.3.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Osrg
Products
Gobgp
CVE-2025-14593

CATPART File Parsing Out-of-Bounds Read Vulnerability

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10900

MODEL File Parsing Out-of-Bounds Write Vulnerability

AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10899

MODEL File Parsing Out-of-Bounds Write Vulnerability

AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10889

CATPART File Parsing Memory Corruption Vulnerability

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10888

MODEL File Parsing Out-of-Bounds Write Vulnerability

AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10887

MODEL File Parsing Memory Corruption Vulnerability

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10886

MODEL File Parsing Memory Corruption Vulnerability

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10884

CATPART File Parsing Out-of-Bounds Write Vulnerability

AA maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more
CVE-2025-10883

CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability

A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max Advance Steel Autocad and 13 more