The bug in Sandboxie‑Plus v1.17.2 and earlier causes the system to incorrectly extract the high nibble when converting a SHA‑1 digest to hexadecimal, zeroing out that nibble. The stored EditPassword hash therefore contains only the low nibble of each byte, shrinking the entropy from 160 bits to 80 bits. This vulnerability is identified as CWE‑328, indicating an inappropriate use of a cryptographic hash function. Because the hash is unsalted SHA‑1, an attacker who obtains the hash can brute‑force the original password far more quickly than with the full digest. The impact is reduced password hash entropy.

The vulnerability affects Sandboxie‑Plus up to and including v1.17.2. Version 1.17.3 and later contain the fix. The issue lives in the EditPassword entry of the sandbox configuration files on Windows systems running the affected editions.

The CVSS score of 2 indicates low impact, and the EPSS score is not available. The vulnerability is not listed in CISA KEV, implying that widespread public exploitation has not been documented. Nonetheless, an attacker with access to the sandbox configuration – for instance via a backup or a local compromise – can obtain the compromised EditPassword hash and, due to the reduced entropy, perform a practical brute‑force attack. The likely attack vector is local or through any channel that exposes the sandbox configuration data. This inference is based on the description.