File Attribute Manipulation Vulnerability in Sandboxie-Plus by Sandboxie

CVE-2026-102280

What is CVE-2026-102280?

Sandboxie-Plus, an open source sandbox-based isolation software for Windows, contains a vulnerability that allows a process within a sandbox to send specific messages to the SbieSvc service, potentially enabling unauthorized modifications to files outside the sandboxed environment. This flaw allows for changes to file attributes, timestamps, and other properties, posing a risk of SYSTEM-level code execution if a privileged process interacts with an attacker-controlled short name path. Users are urged to update to version 1.18.6, which addresses this issue effectively.

References