CVE-2025-64721

CVE-2025-64721 affects Sandboxie versions 1.16.6 and earlier. The SYSTEM-level service SbieSvc.exe exposes SbieIniServer::RC4Crypt to sandboxed processes, where a caller-controlled value_len is not overflow-checked. A large value_len (e.g., 0xFFFFFFF0) can wrap the allocation size, causing a heap...