PT-2026-137184
CVE-2026-102280
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 4.0
6.9
MediumMetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Sandboxie-Plus versions prior to 1.18.6
Description
A process running within a sandbox can send
MSGID FILE SET ATTRIBUTES or MSGID FILE SET SHORT NAME messages to the SbieSvc service. This allows the SYSTEM service to open and modify files located outside the sandbox, enabling changes to file attributes, timestamps, writeability, or 8.3 short names. Furthermore, short-name redirection may lead to SYSTEM code execution if a privileged process resolves an attacker-controlled short-name path in a location that SbieSvc can open.Recommendations
Update Sandboxie-Plus to version 1.18.6.
Found an issue in the description? Have something to add? Feel free to write us 👾