CVE-2026-45313
Last modified
CVE-2026-45313 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread belongs to the sandboxed process or that the function pointer is in the caller address space, and GuiServer::WndHookNotifySlave then calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, (ULONG_PTR)req->threadid) as SYSTEM, allowing a sandboxed process to execute arbitrary code in an unsandboxed host process. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread belongs to the sandboxed process or that the function pointer is in the caller address space, and GuiServer::WndHookNotifySlave then calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, (ULONG_PTR)req->threadid) as SYSTEM, allowing a sandboxed process to execute arbitrary code in an unsandboxed host process. This issue is fixed in version 1.17.6.
Metrics
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| sandboxie-plus | Sandboxie | < 1.17.6 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-45313?
How severe is CVE-2026-45313?
How do I fix CVE-2026-45313?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-45307Speakr is a personal, self-hosted web application designed f…6.1
- CVE-2026-45309AsyncSSH is a Python package which provides an asynchronous …7.5
- CVE-2026-4531A weakness has been identified in Free5GC 4.1.0. Affected is…6.9
- CVE-2026-45310CodeWhale is a DeepSeek + MiMo coding agent in terminal. Pri…7.4
- CVE-2026-45311CodeWhale is a DeepSeek + MiMo coding agent in terminal. Fro…9.6
- CVE-2026-45312RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…9.9
- CVE-2026-45314Open WebUI is a self-hosted artificial intelligence platform…6.1
- CVE-2026-45315Open WebUI is a self-hosted artificial intelligence platform…8.7
- CVE-2026-45316Open WebUI is a self-hosted artificial intelligence platform…3.5
- CVE-2026-45317Open WebUI is a self-hosted artificial intelligence platform…4.6
- CVE-2026-45318Open WebUI is a self-hosted artificial intelligence platform…5.4
- CVE-2026-4532A security vulnerability has been detected in code-projects …7.5
Are you affected by CVE-2026-45313?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST