CVE-2025-46715

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.12, Api_GetSecureParam fails to sanitize incoming pointers, and implicitly trusts that the pointer the user has passed in is safe to write to. GetRegValue then writes the contents of the SBIE registry entry selected to this address. An attacker can pass in a kernel pointer and the driver dumps the registry key contents we requested to it. This can be triggered by anyone on the system, including low integrity windows processes. Version 1.15.12 fixes the issue.

• CWE-787

• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-67p9-6h73-ff7xExploit, Vendor Advisory

Published

May 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4671The Profile Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2025-46710Possible kernel exceptions caused by reading and writing ker…5.7
• CVE-2025-46711Software installed and run as a non-privileged user may cond…5.5
• CVE-2025-46712Erlang/OTP is a set of libraries for the Erlang programming …3.7
• CVE-2025-46713Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46714Sandboxie is a sandbox-based isolation software for 32-bit a…7.8
• CVE-2025-46716Sandboxie is a sandbox-based isolation software for 32-bit a…5.5
• CVE-2025-46717sudo-rs is a memory safe implementation of sudo and su writt…3.3
• CVE-2025-46718sudo-rs is a memory safe implementation of sudo and su writt…3.3
• CVE-2025-46719Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2025-4672The Offsprout Page Builder plugin for WordPress is vulnerabl…8.8
• CVE-2025-46720Keystone is a content management system for Node.js. Prior t…4.3