What is CVE-2025-46715?

CVE-2025-46715 is a high-severity vulnerability in Sandboxie-Plus Sandboxie, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2025-05-22.

How severe is CVE-2025-46715?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2025-46715 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Sandboxie-Plus Sandboxie

CVE-2025-46715

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.12, Api_GetSecureParam fails to sanitize incoming pointers, and implicitly trusts that the pointer the user has passed in is safe to write to. GetRegValue then writes the contents of the SBIE registry entry selected to this address. An attacker can pass in a kernel pointer and the driver dumps the registry key contents we requested to it. This can be triggered by anyone on the system, including low integrity windows processes. Version 1.15.12 fixes the issue.

Vulnerability class: Buffer Overflow

EPSS: 0.002 (13.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sandboxie-plus Sandboxie — versions >= 1.3.0, < 1.15.12

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2025-46715?: CVE-2025-46715 is a high-severity vulnerability in Sandboxie-Plus Sandboxie, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2025-05-22.
How severe is CVE-2025-46715?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2025-46715 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.