What’s Vulnerable › Vulnerabilities
CVE-2025-46714: Sandboxie has Pool Buffer Overflow in SbieDrv.sys API (API_GET_SECURE_PARAM)
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-05-22 · updated 2026-06-17
- Weakness: CWE-120
Description
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to 1.15.12, API_GET_SECURE_PARAM has an arithmetic overflow leading to a small memory allocation and then a extremely large copy into the small allocation. Version 1.15.12 fixes the issue.
Affected products
- sandboxie-plus Sandboxie: from 1.3.0 before 1.15.12 — fixed in 1.15.12
How to fix
Upgrade to a fixed version: sandboxie-plus Sandboxie 1.15.12. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-46714 or the next vulnerability affects your stack