VYPR
← All advisories
High severity7.8NVD Advisory· Published May 22, 2025· Updated Jun 17, 2026

CVE-2025-46715

CVE-2025-46715

Description

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.12, Api_GetSecureParam fails to sanitize incoming pointers, and implicitly trusts that the pointer the user has passed in is safe to write to. GetRegValue then writes the contents of the SBIE registry entry selected to this address. An attacker can pass in a kernel pointer and the driver dumps the registry key contents we requested to it. This can be triggered by anyone on the system, including low integrity windows processes. Version 1.15.12 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Sandboxie Plus/Sandboxie2 versions
    cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*+ 1 more
    • cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*range: >=1.3.0,<1.15.12
    • (no CPE)range: >= 1.3.0, < 1.15.12
  • Sandboxie/Sandboxie-Plusllm-fuzzy
    Range: >=1.3.0,<1.15.12

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.