What is CVE-2026-32603?

CVE-2026-32603 is a medium-severity vulnerability in Sandboxie-plus Sandboxie, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-05-05.

How severe is CVE-2026-32603?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Improper input validation in Sandboxie-plus Sandboxie

CVE-2026-32603

Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the Sandboxie kernel driver. An unprivileged process running inside a Standard Sand…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.000 (3.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.

Affected products

Sandboxie-plus Sandboxie — versions < 1.17.3

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vvf8-cf4j-v8fv (x_refsource_CONFIRM, Exploit, Vendor Advisory)
https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3 (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-32603?: CVE-2026-32603 is a medium-severity vulnerability in Sandboxie-plus Sandboxie, classified under Improper Input Validation. CVSS score: 6.5/10. Published 2026-05-05.
How severe is CVE-2026-32603?: Medium severity. CVSS v3 base score is 6.5 out of 10.