Sandboxie: Improper Neutralization of CRLF Sequences
CVE-2026-34458 is a high-severity improper neutralization of CRLF sequences vulnerability in Sandboxie from Sandboxie-plus, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. Affected Sandboxie versions: < 1.17.3. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.25% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of Sandboxie you run against the affected versions below, and install the vendor's latest release.
- Read the advisory on github.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Sandboxie-plus | Sandboxie | < 1.17.3 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 4.0 | 9.3 | Critical | CNA (github.com) |
| CVSS 3.1 | 8.8 | High | NVD |
Official description
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Neutralization of CRLF Sequences
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How developers prevent this class of flaw
- Appropriately filter or quote CRLF sequences in user-controlled input.
More Improper Neutralization of CRLF Sequences vulnerabilities (CWE-93)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other vulnerabilities in Sandboxie
- 7.7 High severity
- 7.0 High severity
- 8.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
Recent Improper Neutralization of CRLF Sequences vulnerabilities
- 8.8 High severity
- 8.8 High severity
- 8.5 High severity
- 7.5 High severity
- 8.6 High severity
- 9.8 Critical severity
Spotted an error? Tell us.