A denial of service vulnerability in Sandboxie 5.49.7 can be exploited by a local attacker to crash the application, resulting in a loss of containerized security controls.

This is an improper input validation flaw (CWE-1284) occurring within the container folder setting, where the application fails to handle excessively long input strings. The vulnerability can be triggered by a local attacker, regardless of their privilege level, provided they have the ability to interact with the Sandboxie interface.

The successful exploitation of this vulnerability results in an application crash, which disrupts the availability of the sandbox environment. While the impact is localized to the application, it compromises the security posture of systems relying on Sandboxie for process isolation, potentially leaving underlying host processes exposed if the sandbox fails to initialize or maintain its state. The CVSS score of 7.5 reflects the potential for service disruption, though the requirement for local access mitigates the risk of remote, large-scale compromise.

Immediate Action: Update Sandboxie-Plus to a version released after 5.49.7, where input validation for the container folder field has been corrected.

Proactive Monitoring: Monitor system event logs and application crash dumps for signs of repetitive application failures or unexpected shutdowns of the Sandboxie service.

Compensating Controls: Restrict access to the machine to authorized users only, as the vulnerability requires local access to the application interface to trigger the crash.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49844.

The vulnerability in Sandboxie 5.49.7 presents a credible risk for service disruption through a straightforward denial of service attack. Organizations utilizing this software should prioritize updating to a patched version to ensure the integrity and availability of their sandboxing environment. Immediate application of updates is the only effective way to prevent this specific crash condition.