CVE-2025-46716

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to version 1.15.12, ApiSetSecureParam fails to sanitize incoming pointers, and implicitly trusts that the pointer the user has passed in is safe to read...

CVE-2025-46716

CVE-2025-46716 affects Sandboxie (Sandboxie or Sandboxie-plus) for Windows. The issue is in Api_SetSecureParam, which prior to v1.15.12 fails to sanitize incoming pointers and implicitly trusts the user-supplied pointer. As a result, SetRegValue can read an arbitrary address (potentially a kernel...