Technical impact
The vulnerability is a stack buffer overflow (CWE‑121) in the RunSbieCtrl handler of the SbieIniServer component of sandboxie‑plus. The handler copies an arbitrary payload into a fixed‑size WCHAR buffer without length verification, allowing an overflow that can crash the SbieSvc service or, with crafted input, lead to code execution with SYSTEM privileges.
Affected Systems
Sandboxie‑Plus versions 1.17.2 and earlier are affected. This open‑source sandbox isolation tool for Windows runs a service pipe with a NULL DACL, enabling any local interactive process to connect to the pipe. Users of an affected version should upgrade to 1.17.3 or later to eliminate the flaw.
Risk and Exploitability
The flaw has a CVSS score of 7.3, indicating high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is local: any interactive process can open the service pipe and send an oversized payload, triggering the buffer overflow. Successful exploitation could crash the service or allow execution of injected code with SYSTEM rights, resulting in local privilege escalation or denial of service.
