CVE-2026-34596

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface, UpdUtil.exe is spawned as SYSTEM by SbieSvc but stages files in the user-writable %TEMP%\sandboxie-updater directory. After UpdUtil verifies file hashes against the signed addon manifest, install.bat extracts files.cab and executes config.exe from its contents. Between hash verification and extraction, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM. No UAC prompt is required. This issue has been fixed in version 1.17.3.

• CWE-367

• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-xjvp-63f2-v585Exploit, Vendor Advisory
• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-xjvp-63f2-v585Exploit, Vendor Advisory

Published

May 5, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34590Postiz is an AI social media scheduling tool. Prior to versi…5.4
• CVE-2026-34591Poetry is a dependency manager for Python. From version 1.4.…6.5
• CVE-2026-34592Coolify is an open-source and self-hostable tool for managin…7.7
• CVE-2026-34593Ash Framework is a declarative, extensible framework for bui…7.5
• CVE-2026-34594Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34595Parse Server is an open source backend that can be deployed …4.3
• CVE-2026-34597Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34598YesWiki is a wiki system written in PHP. Prior to version 4.…6.1
• CVE-2026-34599Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-3460The REST API TO MiniProgram plugin for WordPress is vulnerab…5.3
• CVE-2026-34600Joplin is an open source note-taking and to-do application t…5.7
• CVE-2026-34601xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…7.5