CVE-2025-46713
📋 TL;DR
CVE-2025-46713 is an arithmetic overflow vulnerability in Sandboxie's memory allocation subsystem that leads to buffer overflow. This allows attackers to execute arbitrary code within the sandbox environment. All users running Sandboxie versions before 1.15.12 on Windows NT-based systems are affected.
💻 Affected Systems
- Sandboxie
- Sandboxie-Plus
📦 What is this software?
Sandboxie by Sandboxie Plus
⚠️ Risk & Real-World Impact
Worst Case
Full sandbox escape leading to arbitrary code execution on the host system with the same privileges as the Sandboxie process.
Likely Case
Arbitrary code execution within the sandbox environment, potentially compromising isolated applications and data.
If Mitigated
Limited impact if sandbox is properly configured with minimal privileges and no sensitive data is processed within it.
🎯 Exploit Status
Exploitation requires triggering the vulnerable memory allocation path, likely through specific API calls within the sandbox.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.15.12
Vendor Advisory: https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-5g85-6p6v-r479
Restart Required: Yes
Instructions:
1. Download Sandboxie version 1.15.12 or later from the official repository. 2. Close all sandboxed applications. 3. Run the installer to upgrade. 4. Restart the system to ensure all components are updated.
🔧 Temporary Workarounds
Disable Sandboxie Service
windowsTemporarily disable the Sandboxie service to prevent exploitation while awaiting patch deployment.
sc stop SbieSvc
sc config SbieSvc start= disabled
Restrict Sandbox Usage
allLimit sandbox usage to trusted applications only and avoid running unknown or untrusted content.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of untrusted applications within the sandbox.
- Deploy endpoint detection and response (EDR) solutions to monitor for suspicious memory allocation patterns.
🔍 How to Verify
Check if Vulnerable:
Check Sandboxie version in About dialog or via 'SbieCtrl.exe /version' command.Check Version:
SbieCtrl.exe /versionVerify Fix Applied:
Verify version is 1.15.12 or higher and check that the service is running without errors.📡 Detection & Monitoring
Log Indicators:
- Unusual memory allocation errors in Sandboxie logs
- Crash dumps from SbieSvc.exe
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=1000 OR EventID=1001 Source=SbieSvc.exe | search "access violation" OR "buffer overflow"