CVE-2026-32603

MediumCVSS 6.5/10Last modified Jul 25, 2026

Description

Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the Sandboxie kernel driver. An unprivileged process running inside a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriverApi driver, triggering an immediate kernel crash (BSOD). The vulnerability affects the Standard Sandbox configuration both with and without dropped administrator privileges, but does not affect the Security Hardened Sandbox configuration. This issue has been fixed in version 1.17.3. Users who cannot update can use the Security Hardened Sandbox configuration as a workaround.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2026
Last modified: Jul 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-326049.9Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a ba CVE-2026-326057.5nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to v CVE-2026-326067.6IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used CVE-2026-326075.4Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2 CVE-2026-326087.0Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands CVE-2026-326097.5Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration CVE-2026-32619.8A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the CVE-2026-326108.1Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a defaul CVE-2026-326119.1Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the Timescale CVE-2026-326125.4Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference CVE-2026-326139.9Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language)CVE-2026-326147.5Go ShangMi (Commercial Cryptography) Library (GMSM) is a cryptographic library that covers the Chinese commercial cryptographic public algor