The vulnerability resides in the Sandboxie kernel driver. An unprivileged process inside a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriverApi driver, causing an immediate kernel crash and resulting in a blue screen. This denial of service can be triggered even when the sandboxed process has dropped administrator privileges, but it does not affect the Security Hardened Sandbox configuration.

Sandboxie software, versions 1.17.2 and older, running on Windows, is affected. The issue occurs specifically when using the Standard Sandbox configuration. The Security Hardened Sandbox configuration is not impacted.

The CVSS score of 8.2 indicates a high severity. Since the exploit is local and requires an unprivileged process inside the sandbox, the likelihood depends on the user running potentially malicious code within a Standard Sandbox. The vulnerability is not listed in the CISA KEV catalog and the EPSS score is not available, but the ability to force a system crash makes it a high‑impact local denial of service. The attacker can trigger this behavior by sending a crafted packet to the driver from within the sandboxed environment.