Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34458 INI Injection Vulnerability in Sandboxie-Plus 1.17.2 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34458
Post summary
The text announces an INI injection vulnerability in Sandboxie-Plus (up to version 1.17.2) and directs readers to a vulnerability details page.
🚨*CVE* CVE-2026-34458 Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard loca… https://www.cve.org/CVERecord?id=CVE-2026-34458 ----- Traducción: CVE-2026-34458 San… http://infoflow.cloud`
Post summary
The post announces CVE-2026-34458, a Sandboxie-Plus INI injection flaw affecting versions 1.17.2 and earlier, providing basic technical details but no PoC, exploit, patch, or active exploitation information.
CVE-2026-34458 Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard loca… https://www.cve.org/CVERecord?id=CVE-2026-34458
Post summary
The text announces an INI injection flaw in Sandboxie‑Plus (v1.17.2 and earlier) that allows local users to exploit the vulnerability, with no evidence of active exploitation or available patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sandboxie-plus | sandboxie | - | - | - |