CVE-2025-64721
📋 TL;DR
This vulnerability in Sandboxie allows sandboxed processes to exploit an integer overflow in the SbieSvc.exe service, leading to heap overflow and arbitrary code execution with SYSTEM privileges. It affects all users running Sandboxie versions 1.16.6 and below on Windows NT-based systems. Successful exploitation completely compromises the host system.
💻 Affected Systems
- Sandboxie
📦 What is this software?
Sandboxie by Sandboxie Plus
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install persistent malware, steal credentials, and pivot to other systems.
Likely Case
Local privilege escalation from sandboxed processes to SYSTEM, enabling full control of the host machine.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are enforced, though local compromise remains possible.
🎯 Exploit Status
Exploitation requires local access to run sandboxed processes. The vulnerability is in a SYSTEM service, making exploitation straightforward once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.16.7
Vendor Advisory: https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w476-j57g-96vp
Restart Required: Yes
Instructions:
1. Download Sandboxie version 1.16.7 or later from the official repository. 2. Close all sandboxed applications. 3. Run the installer to upgrade. 4. Restart the system to ensure the service update takes effect.
🔧 Temporary Workarounds
Disable Sandboxie Service
windowsTemporarily disable the SbieSvc.exe service to prevent exploitation
sc stop SbieSvc
sc config SbieSvc start= disabled
🧯 If You Can't Patch
- Restrict user access to systems running vulnerable Sandboxie versions
- Implement application whitelisting to prevent execution of unauthorized processes
🔍 How to Verify
Check if Vulnerable:
Check Sandboxie version in About dialog or verify SbieSvc.exe version is below 1.16.7Check Version:
wmic product where name="Sandboxie" get versionVerify Fix Applied:
Confirm Sandboxie version is 1.16.7 or higher in About dialog📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from SbieSvc.exe
- Heap corruption events in Windows Event Logs
- Sandboxie service crashes
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
EventID=4688 AND ProcessName="SbieSvc.exe" AND ParentProcessName contains "sandboxed"🔗 References
- https://github.com/sandboxie-plus/Sandboxie/commit/000492f8c411d24292f1b977a107994347bc7dfa
- https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.16.7
- https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w476-j57g-96vp
- https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w476-j57g-96vp
