https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-34596.htmlhttps://patchthecve.com/cve/CVE-2026-34596.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.0: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface, UpdUtil.exe is spawned as SYSTEM by Sbihttps://patchthecve.com/cve/CVE-2026-34527.htmlhttps://patchthecve.com/cve/CVE-2026-34527.htmlFri, 24 Jul 2026 22:10:00 +0000MEDIUM 5.3: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword converts a SHA-1 digest to hexadecimal incorrectly. The high nibble of each byte is shifted right by 8 instead of 4, which always produces zero for an 8-bit valuhttps://patchthecve.com/cve/CVE-2026-34464.htmlhttps://patchthecve.com/cve/CVE-2026-34464.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 8.8: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server field from NAMED_PIPE_OPEN_REQ into a fixed WCHAR pipename[160] stack buffer using wcscat without verifying null termination. The handler onlyhttps://patchthecve.com/cve/CVE-2026-34462.htmlhttps://patchthecve.com/cve/CVE-2026-34462.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.8: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from request structures into WCHAR[40] stack buffers using wcscpy https://patchthecve.com/cve/CVE-2026-34461.htmlhttps://patchthecve.com/cve/CVE-2026-34461.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 7.8: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandbhttps://patchthecve.com/cve/CVE-2026-34459.htmlhttps://patchthecve.com/cve/CVE-2026-34459.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 8.8: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request withhttps://patchthecve.com/cve/CVE-2026-34458.htmlhttps://patchthecve.com/cve/CVE-2026-34458.htmlFri, 24 Jul 2026 22:10:00 +0000HIGH 8.8: Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxhttps://patchthecve.com/cve/CVE-2026-32603.htmlhttps://patchthecve.com/cve/CVE-2026-32603.htmlSat, 25 Jul 2026 11:10:00 +0000MEDIUM 6.5: Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the Sandboxie kernel driver. An unprivileged process running inside a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriver