Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory, exposing them to potential interception. The vulnerability is particularly severe during password modification operations, where both old and new passwords are passed as plaintext command-line arguments to the Imbox process without any encryption or obfuscation. This implementation flaw allows any process within the user session, including unprivileged processes, to retrieve these sensitive credentials by reading the command-line arguments, thereby bypassing standard privilege requirements and creating a significant security risk. This is fixed in version 1.16.2.
History

Mon, 04 Aug 2025 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Sandboxie-plus
Sandboxie-plus sandboxie
CPEs cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*
Vendors & Products Sandboxie-plus
Sandboxie-plus sandboxie
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}


Wed, 30 Jul 2025 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Sandboxie
Sandboxie sandboxie
Vendors & Products Sandboxie
Sandboxie sandboxie

Tue, 29 Jul 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 29 Jul 2025 13:15:00 +0000

Type Values Removed Values Added
Description Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory, exposing them to potential interception. The vulnerability is particularly severe during password modification operations, where both old and new passwords are passed as plaintext command-line arguments to the Imbox process without any encryption or obfuscation. This implementation flaw allows any process within the user session, including unprivileged processes, to retrieve these sensitive credentials by reading the command-line arguments, thereby bypassing standard privilege requirements and creating a significant security risk. This is fixed in version 1.16.2.
Title Sandboxie exposes encrypted sandbox key during password change
Weaknesses CWE-312
CWE-322
CWE-497
CWE-522
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-07-29T12:47:50.414Z

Updated: 2025-07-29T13:29:56.118Z

Reserved: 2025-07-21T23:18:10.281Z

Link: CVE-2025-54422

cve-icon Vulnrichment

Updated: 2025-07-29T13:29:43.782Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-29T13:15:27.823

Modified: 2025-08-04T17:30:08.827

Link: CVE-2025-54422

cve-icon Redhat

No data.