Sandboxie-Plus v1.17.2 and earlier contain a stack buffer overflow in several ProcessServer handlers (KillAllHandler, SuspendAllHandler, RunSandboxedHandler) that use the wide‑character copy function wcscpy to copy a boxname field into a fixed stack buffer without verifying null termination. When the service pipe is supplied with a packet larger than the request structure, the attacker can supply arbitrary wide characters after the boxname field. The unbounded copy will read past the intended field into the stack buffer, corrupting control data and potentially allowing the attacker to execute arbitrary code with the privileges of the SbieSvc service. The existing NULL DACL on the service pipe permits any local process to connect before authorization checks, making the vulnerability exploitable locally without prior privilege.

The affected product is Sandboxie‑Plus from the Sandboxie family. Versions 1.17.2 and earlier are impacted. The vulnerability has been addressed by upgrading to version 1.17.3 or later.

The CVSS score of 7.3 indicates a high severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker connecting to the sandbox service pipe, which is accessible to any user due to the NULL DACL. Because the unsafe copy occurs before authentication, an attacker can trigger a stack corruption that may lead to a crash or, if successfully exploited, gain SYSTEM level execution.