CVE-2025-46716

Sandboxie Arbitrary Kernel Read in SbieDrv.sys API (API_SET_SECURE_PARAM)

State: Published
Severity: 5.5 Medium
Published: May 22, 2025
Updated: May 22, 2025
Reserved: Apr 28, 2025

Description

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.12, Api_SetSecureParam fails to sanitize incoming pointers, and implicitly trusts that the pointer the user has passed in is safe to read from. SetRegValue then reads an arbitrary address, which can be a kernel pointer, into a HKLM Security SBIE registry value. This can later be retrieved by API_GET_SECURE_PARAM. Version 1.15.12 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
Sandboxiesandboxie-plus	>= 1.3.0, < 1.15.12Affected

References

https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-3984-r877-q7xp

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.