CVE-2025-64721: Sandboxie-plus RCE Vulnerability

CVE-2025-64721 Overview

CVE-2025-64721 is a critical integer overflow vulnerability in Sandboxie, a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. The vulnerability exists in the SYSTEM-level service SbieSvc.exe, which exposes SbieIniServer::RC4Crypt to sandboxed processes. The handler adds a fixed header size to a caller-controlled value_len parameter without performing overflow checking. When a large value_len value (e.g., 0xFFFFFFF0) is provided, the allocation size wraps, causing a heap overflow when attacker data is copied into the undersized buffer.

Critical Impact

This vulnerability allows sandboxed processes to execute arbitrary code as SYSTEM, fully compromising the host system and defeating the entire purpose of the sandbox isolation mechanism.

Affected Products

• Sandboxie Plus versions 1.16.6 and below
• Sandboxie for 32-bit Windows NT-based operating systems
• Sandboxie for 64-bit Windows NT-based operating systems

Discovery Timeline

• 2025-12-11 - CVE-2025-64721 published to NVD
• 2025-12-22 - Last updated in NVD database

Technical Details for CVE-2025-64721

Vulnerability Analysis

This vulnerability represents a classic integer overflow leading to heap overflow scenario. The SbieIniServer::RC4Crypt function in SbieSvc.exe processes requests from sandboxed processes. When calculating the buffer size for allocation, the code adds a fixed header size (sizeof(SBIE_INI_RC4_CRYPT_RPL)) to a user-controlled value_len parameter. Since no overflow check was performed before the addition, an attacker could supply an extremely large value that causes the sum to wrap around due to integer overflow.

For example, if value_len is set to 0xFFFFFFF0 and the header size is added, the resulting allocation size wraps to a small value. When the actual data copy operation occurs, it writes value_len bytes (the original large value) into this undersized buffer, resulting in a heap overflow.

Root Cause

The root cause is CWE-190 (Integer Overflow or Wraparound). The vulnerable code path in sbieiniserver.cpp failed to validate that the value_len parameter, when added to the fixed header size, would not exceed the maximum value representable by ULONG. This missing bounds check allowed malicious sandboxed processes to trigger an integer wrap, leading to an undersized heap allocation followed by a buffer overflow during data copy operations.

Attack Vector

The attack vector is accessible from within a sandboxed process, which can communicate with the SYSTEM-level SbieSvc.exe service. An attacker running malicious code inside a Sandboxie sandbox can craft a specially constructed SBIE_INI_RC4_CRYPT_REQ request with a malicious value_len value. When processed by the service, the integer overflow causes a heap corruption that can be leveraged to achieve arbitrary code execution with SYSTEM privileges, effectively escaping the sandbox entirely.

// Security patch from sbieiniserver.cpp
// Source: https://github.com/sandboxie-plus/Sandboxie/commit/000492f8c411d24292f1b977a107994347bc7dfa

     SBIE_INI_RC4_CRYPT_REQ *req = (SBIE_INI_RC4_CRYPT_REQ *)msg;
     if (req->h.length < sizeof(SBIE_INI_RC4_CRYPT_REQ))
         return SHORT_REPLY(STATUS_INVALID_PARAMETER);
  
+    if (req->value_len > (ULONG_MAX - sizeof(SBIE_INI_RC4_CRYPT_RPL)))
+        return SHORT_REPLY(STATUS_INVALID_PARAMETER);
 
     ULONG rpl_len = sizeof(SBIE_INI_RC4_CRYPT_RPL) + req->value_len;
     SBIE_INI_RC4_CRYPT_RPL *rpl = (SBIE_INI_RC4_CRYPT_RPL *)LONG_REPLY(rpl_len);
     if (!rpl)

The patch adds a critical validation check that ensures value_len cannot exceed the maximum safe value that prevents integer overflow when added to the header size.

Detection Methods for CVE-2025-64721

Indicators of Compromise

• Unexpected crashes or restarts of the SbieSvc.exe service
• Anomalous memory allocation patterns or heap corruption errors in Windows Event logs related to Sandboxie services
• Evidence of code execution outside the sandbox context from previously sandboxed processes
• SYSTEM-level processes spawned unexpectedly by sandboxed applications

Detection Strategies

• Monitor for abnormal IPC communications between sandboxed processes and SbieSvc.exe containing unusually large parameter values
• Implement EDR rules to detect heap spray patterns or memory corruption attempts targeting Sandboxie services
• Deploy memory protection mechanisms that can identify heap overflow exploitation attempts
• Audit process creation events for unexpected privilege escalation from sandboxed process contexts

Monitoring Recommendations

• Enable detailed logging for Sandboxie service operations and monitor for STATUS_INVALID_PARAMETER returns that may indicate exploitation attempts
• Configure security monitoring to track all SYSTEM-level process activity associated with Sandboxie components
• Implement file integrity monitoring on Sandboxie binaries to detect unauthorized modifications
• Monitor Windows Security Event logs for evidence of privilege escalation from sandbox-contained processes

How to Mitigate CVE-2025-64721

Immediate Actions Required

• Upgrade Sandboxie to version 1.16.7 or later immediately
• Review systems for signs of compromise if running affected versions in untrusted environments
• Consider temporarily disabling Sandboxie services on critical systems until patching is complete
• Implement network segmentation to limit potential lateral movement if exploitation has occurred

Patch Information

Sandboxie-plus has released version 1.16.7 which addresses this vulnerability. The fix adds proper bounds checking to ensure the value_len parameter cannot cause an integer overflow when calculating buffer allocation sizes. The patch validates that value_len does not exceed ULONG_MAX - sizeof(SBIE_INI_RC4_CRYPT_RPL) before proceeding with memory allocation.

For detailed patch information, refer to the GitHub Security Advisory GHSA-w476-j57g-96vp and the GitHub Release v1.16.7.

Workarounds

• Restrict which applications can run within Sandboxie to only trusted software until patching is applied
• Implement application whitelisting to prevent execution of potentially malicious code within sandboxes
• Deploy additional endpoint protection that can detect and block heap overflow exploitation attempts

# Verify Sandboxie version and update status
# Check current installed version
wmic product where "name like '%%Sandboxie%%'" get version

# After updating, verify the fix is applied
# Version should be 1.16.7 or higher