CVE-2025-46714 Overview
CVE-2025-46714 affects Sandboxie, a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. The vulnerability exists in the API_GET_SECURE_PARAM handler, where an arithmetic overflow causes a small memory allocation followed by an extremely large copy into that undersized buffer. The flaw is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Sandboxie versions from 1.3.0 up to but not including 1.15.12 are affected, and version 1.15.12 fixes the issue.
Critical Impact
Local attackers with low privileges can trigger a heap buffer overflow in Sandboxie's kernel-level API handler, potentially leading to arbitrary code execution, privilege escalation, and full compromise of host confidentiality, integrity, and availability.
Affected Products
- Sandboxie-plus Sandboxie versions 1.3.0 through 1.15.11
- Sandboxie Plus editions on 32-bit Windows NT-based systems
- Sandboxie Plus editions on 64-bit Windows NT-based systems
Discovery Timeline
- 2025-05-22 - CVE-2025-46714 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46714
Vulnerability Analysis
The vulnerability resides in the API_GET_SECURE_PARAM API handler within Sandboxie's kernel driver. When processing input parameters, the handler performs an arithmetic calculation on user-controlled size values that overflows an integer. The overflow results in the allocator receiving a small size value, which succeeds and returns an undersized buffer.
The subsequent copy operation, however, uses the pre-overflow size value that reflects the attacker's original large input. This mismatch causes an extremely large copy into the small allocation, corrupting adjacent kernel heap memory. Because Sandboxie's driver operates with elevated privileges to enforce sandbox isolation, corruption in this context can undermine the very isolation boundary Sandboxie is designed to enforce.
Root Cause
The root cause is missing arithmetic overflow validation before the memory allocation and copy sequence in API_GET_SECURE_PARAM. The handler trusts arithmetic on attacker-influenced size values without checking for integer wraparound. This is a classic instance of [CWE-120], where the copy length is derived independently from the allocation length after overflow.
Attack Vector
Exploitation requires local access with low privileges on a system running a vulnerable Sandboxie version. An attacker invokes the API_GET_SECURE_PARAM interface with crafted parameters that trigger the arithmetic overflow. No user interaction is required. The vulnerability manifests in a driver's IOCTL-style API handler; see the GitHub Security Advisory for technical details on the affected code path.
Detection Methods for CVE-2025-46714
Indicators of Compromise
- Unexpected crashes or bugchecks referencing the Sandboxie driver (SbieDrv.sys) in Windows Event Viewer or WER reports
- Presence of Sandboxie installations with version strings between 1.3.0 and 1.15.11 on managed endpoints
- Anomalous processes issuing repeated IOCTL requests to the Sandboxie driver device object
Detection Strategies
- Inventory endpoints for installed Sandboxie versions and flag any release earlier than 1.15.12
- Monitor kernel crash telemetry for faults originating in Sandboxie driver modules
- Correlate low-privilege process activity with unusual driver interactions preceding system instability
Monitoring Recommendations
- Enable Windows kernel crash dump collection and forward reports to centralized log storage for analysis
- Track process-to-driver interactions targeting Sandboxie device objects from non-administrative user contexts
- Alert on Sandboxie service or driver restarts that follow suspicious local process activity
How to Mitigate CVE-2025-46714
Immediate Actions Required
- Upgrade all Sandboxie installations to version 1.15.12 or later, which contains the fix for the API_GET_SECURE_PARAM overflow
- Restrict local login access on systems where Sandboxie is deployed until patching is complete
- Audit endpoints for unauthorized or outdated Sandboxie installations across the environment
Patch Information
Sandboxie version 1.15.12 fixes the arithmetic overflow in API_GET_SECURE_PARAM. Administrators should download the patched release from the official Sandboxie-plus project and deploy it across all affected endpoints. Refer to the GitHub Security Advisory GHSA-c5h5-54gp-xh4q for full remediation details.
Workarounds
- If immediate patching is not feasible, uninstall Sandboxie on systems where sandboxing is not operationally required
- Limit interactive and remote local access to trusted administrators to reduce exposure to local exploitation
- Apply application allowlisting to prevent execution of untrusted binaries capable of invoking the vulnerable driver API
# Verify installed Sandboxie version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*Sandboxie*" } |
Select-Object DisplayName, DisplayVersion, Publisher
# Systems reporting DisplayVersion below 1.15.12 must be upgraded
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
