CVE-2026-102280 · Package
NO FIX YET · SEE WHAT TO DO
Sandboxie-Plus before 1.18.6 lets a process inside a sandbox send requests to the SbieSvc SYSTEM service that change attributes, timestamps, writability or 8.3 short names of files outside the sandbox. A short-name redirection can also contribute to code execution as SYSTEM when a privileged process resolves an attacker-controlled short-name path.
first public Oct 10, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Windows machines where Sandboxie-Plus is installed and used to run untrusted programs inside a sandbox, since the flaw lets sandboxed code reach the SYSTEM service. Machines without Sandboxie-Plus installed are not exposed to this issue.
Not affected if fixed-version, not-installed
Who cares sandboxie-plus, windows
SbieSvc service on Windows machines running Sandboxie-Plus and note its version1.18.6Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.