CVE-2025-54422
- Source
- https://cve.org/CVERecord?id=CVE-2025-54422
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54422.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-54422
- Aliases
-
- GHSA-jp7r-vgv9-43p7
- Published
- 2025-07-29T12:47:50.414Z
- Modified
- 2026-08-12T15:16:41.563658Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Sandboxie exposes encrypted sandbox key during password change
- Details
-
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory, exposing them to potential interception. The vulnerability is particularly severe during password modification operations, where both old and new passwords are passed as plaintext command-line arguments to the Imbox process without any encryption or obfuscation. This implementation flaw allows any process within the user session, including unprivileged processes, to retrieve these sensitive credentials by reading the command-line arguments, thereby bypassing standard privilege requirements and creating a significant security risk. This is fixed in version 1.16.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-312", "CWE-322", "CWE-497", "CWE-522" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54422.json" }- References
-
- https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.16.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54422.json
- https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-jp7r-vgv9-43p7
- https://nvd.nist.gov/vuln/detail/CVE-2025-54422
- https://github.com/sandboxie-plus/Sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a
Affected packages
Git / github.com/sandboxie-plus/sandboxie
Affected ranges
- Type
- GIT
- Repo
- https://github.com/sandboxie-plus/sandboxie
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.16.2" } ], "source": [ "CPE_RANGE", "REFERENCES" ], "cpe": "cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*" }
Affected versions
0.*
0.5.5
0.6.0
0.6.5
0.6.7
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.8.0
0.8.1
0.8.2
0.8.5
0.8.6
0.8.7
0.8.7b
0.8.8
0.9.0a
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.7b
0.9.7c
0.9.7d
0.9.7e
0.9.8
0.9.8c
0.9.8d
1.*
1.0.0
1.0.1
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.19
1.0.2
1.0.20
1.0.22
1.0.3
1.0.4
1.0.5
1.0.6
1.0.8
1.1.0
1.3.4
v0.*
v0.1
v0.2
v0.2.1
v0.2.2
v0.3
v0.3.5
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.5.0
v0.5.1
v0.5.2
v0.5.3a
v0.5.3b
v0.5.4
v0.5.4b
v0.5.4c
v0.5.4d
v1.*
v1.1.2
v1.1.3
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.12.9
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.14.0
v1.14.1
v1.14.10
v1.14.3
v1.14.4
v1.14.5
v1.14.6
v1.14.7
v1.14.8
v1.14.9
v1.15.0
v1.15.1
v1.15.10
v1.15.12
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.15.6
v1.15.7
v1.15.8
v1.15.9
v1.16.0
v1.16.1
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.5
v1.4.0
v1.4.1
v1.4.2
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.6.1
v1.6.1a
v1.6.1b
v1.6.2b
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1
v1.8.2
v1.8.2a
v1.8.3
v1.8.4
v1.9.0
v1.9.1
v1.9.3
v1.9.4
v1.9.6
v1.9.7
v1.9.8
v5.*
v5.40
v5.40.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54422.json"
vanir_signatures
[
{
"target": {
"file": "SandboxieTools/ImBox/ImBox.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-1064bc52",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"107596943462797987190773672731711448240",
"36927308367978223141023361544943100949",
"164117099482252342607267632333170597594",
"149855338126108501608869062982236270801",
"137868712313279012343223119627007908219",
"223512307135820371898845907235741051056",
"218013103332846008664097000510183394717",
"163813335660178238750344319234667213560",
"127000027502188248335950934621874079915",
"273032990415983285048881485875431557155",
"311950702866863729650236766568167682348",
"277421942705820476792691831416885210211",
"215817338755772175068110580310671879318",
"313416105896097772106045231472452974668",
"59674159771944208298251917528058416372",
"321169459558632143881048241260473376362",
"67073996470819091862326087398036074279",
"37774079811945896285896366474200949048",
"19167622922004138633086032796866044724",
"151244943894558128437521011089160680131",
"67414408025240361268915519838034467818",
"299223446216045818966025874376255542986",
"257232157448061185377146100631499240813",
"193297489990940967773432708758067644763",
"245245044932148994433307309761009612487",
"286622192838359676242016125916245910854",
"35678434012213227113127275490410984922",
"234371997725731131799791885782341259933",
"286683095405257156496394280304936456319",
"72998799481584944837210762215211220220",
"107627431427635307093949615975720283870",
"225723474389109254183542623060291897301",
"105233927634036777918191323697314857261",
"151033809121964705153500027669742554046",
"296934734299628818997904211512494051188",
"153350782283504605617261536102768294868",
"227433186673775813407775435977511120475",
"22812784501806129801496387069290210716",
"154639645200663185660943346404200701611",
"13387859191946338000340187574181267498",
"4580283267622057503328574977088248320"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "SandboxieTools/ImBox/CryptoIO.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-1ea35048",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52146049766935005291308756727341359907",
"280447330682009747664996783129400064511",
"1498237105958974054093785587914565419",
"235863013048890752467746092569856446009",
"237607440259576842261579790405871996926",
"48311048942869431758774511888246078084",
"151634580385964028106972279576267552837",
"223934880482722629425553747828715574628",
"57201813560539026766664952878424141605",
"107575197191955646042792108398486042781",
"183846710621077454668952472628237970380",
"274688941380799618803847745881928140490",
"37213391183412405438533644426940472383",
"27002421361226727311622847876702375999",
"224919286644988493862804173951997304549",
"252171407474546281440753909486192786791",
"141514948725839342969020868357387179064"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "COptionsWindow::OnSetPassword",
"file": "SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-2443ea6b",
"signature_version": "v1",
"digest": {
"length": 759.0,
"function_hash": "154337660191376822850110220252680709480"
},
"signature_type": "Function"
},
{
"target": {
"function": "MountManager::MountImDisk",
"file": "Sandboxie/core/svc/MountManager.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-25b41e49",
"signature_version": "v1",
"digest": {
"length": 4017.0,
"function_hash": "251617150705950962245243230331125096932"
},
"signature_type": "Function"
},
{
"target": {
"file": "SandboxieTools/ImBox/ImBox.h"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-2d8105b8",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292900611042214047034468125085358320696"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "SandboxieTools/ImBox/ImDiskIO.h"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-42c2abc3",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"190419815737865675459010634286279347334",
"96091118314099426757323310118471990817",
"178264645807385888671880582572979499506",
"305035234927460296976322939201693334890",
"95622105515504691444689704255639476073",
"207551433699708085518588208557249578982",
"201229045399732496886684758133031593399",
"176638233021360148520760837131501202833",
"138546823720701520785230211108689096812",
"53368633372313622757546112882130336071"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "CImDiskIO::DoComm",
"file": "SandboxieTools/ImBox/ImDiskIO.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-4da3e889",
"signature_version": "v1",
"digest": {
"length": 3238.0,
"function_hash": "298579605860088591166069457711630859941"
},
"signature_type": "Function"
},
{
"target": {
"function": "CImDiskIO::CImDiskIO",
"file": "SandboxieTools/ImBox/ImDiskIO.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-5c923017",
"signature_version": "v1",
"digest": {
"length": 349.0,
"function_hash": "69735180894294478631421687835415941726"
},
"signature_type": "Function"
},
{
"target": {
"file": "SandboxieTools/ImBox/ImDiskIO.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-86207091",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50294588361685204381783527240798381159",
"48360497710768122434773291971590747504",
"253919913915184357960132686621445170923",
"136144661077024105070499637245936039469",
"151541201155442042036145121588017921065",
"35432452369369344386600576454840074941",
"28607795908139409291646994276804759533",
"111748415259583425599878147133663358591",
"234714710353698074475497780289562561191",
"323272670099240914790075075619085738605",
"293033848902004105130542610447795783778",
"221913792515329460414472619397896719941",
"262279748956083850760757077011673620361",
"292913425112462242691324323574899434276",
"274791678097340319310216914162572999060",
"328262626929815748766021423031715787380",
"21241412127914815800879950297472493526",
"240867655781794941347880150967887571583",
"11099198955356318835239076661419667611",
"124809131347387971611166867872194679471",
"265688325961729347528332771535924903365",
"164959199293098102007397654790458929912",
"308481846473367282113070661439209269536",
"59734888147646533118227288682159396853",
"317593993066366776895455215989119800295",
"219198898372106417068678894555869864873"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "Sandboxie/core/svc/MountManager.h"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-88eec52a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300499377449823686518448867478904119043",
"38491642583971068891706233184382379491",
"169698109674763615695932000159482693693",
"19181795151307084579423808245492342060"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "SandboxiePlus/QSbieAPI/SbieAPI.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-8c3789a6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"159988019053995777817094951608459066888",
"191542905507526994408085354610470697449",
"132443537786361749480467199737746018673",
"181576697987492944196909536148288069512",
"333070986558113108707321739815478173704",
"313205476466854826960556082473460813475"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-8fc1b3da",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"46217157095509700578964413494500972199",
"5171389671263113874737310663230147434",
"215311682293791111453568375783999925763",
"202333463056745869017843881658081465477",
"238032855799394335854187654636115008668",
"144376468697401184760354275852750424181",
"338857444470467591002244365204523812649",
"121932417188627585769925134268137454780",
"316217150575257445648432500949543522043",
"117265876126853291569265503675865942354"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "CImDiskIO_Thread",
"file": "SandboxieTools/ImBox/ImDiskIO.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-931da63d",
"signature_version": "v1",
"digest": {
"length": 2441.0,
"function_hash": "265135607476577513090699740856151344132"
},
"signature_type": "Function"
},
{
"target": {
"file": "SandboxiePlus/QSbieAPI/SbieAPI.h"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-a0eae131",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"181171300181348237416338175247908797606",
"269767340215719360080557904807549756743",
"113560951840075170522731579153543641390"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "CCryptoIO::CCryptoIO",
"file": "SandboxieTools/ImBox/CryptoIO.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-a5f588f6",
"signature_version": "v1",
"digest": {
"length": 474.0,
"function_hash": "240155620713877872693233101120024146720"
},
"signature_type": "Function"
},
{
"target": {
"file": "Sandboxie/core/svc/MountManager.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-c379b60e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"4591696884550544129537039287352741818",
"210220016368881447480641044959445046270",
"101858736178594181241036836564234452860",
"148226282933439386781274527244341018994",
"299349114178604388439355137073424463344",
"73488665204818917915342558636085968379",
"1232452297849127417884521436084602607",
"105983820239055732708615371184540323746",
"250524123005953931591036518892714895661",
"307954320075102492859637195146934920995",
"157423464146358725529200555183604645121",
"44378695721078967567310337669469532076",
"191120793205313038855614452178039403255",
"237889297024340361193666743900476318604",
"339712600949665911826401659821573251484",
"229998165569832840464055174503690509352",
"231599542129224357174869863838336445998",
"77296664379332022653860196299573052333",
"34810098804202341114210462753927425795",
"322169826085252865540576298918542467150",
"164084704225884304947079653778352301379",
"216143028468003110021205979287316357673",
"172907888618816707934972333671705537468",
"211269541379210776424564020047722325234",
"108325000287818703992249235011224726814",
"259646749356058021572412373880900727770",
"76789856777739344315209566078723738427",
"189951623631120977011495521721550055457",
"101041998887282370855461816519322580183",
"241074437516513066348388334179397987371",
"138406608895418833341380878149280496283",
"181644400804937470992496160570124978804",
"127438064382839725167389690525422665519",
"172931032344331080381230338300702523847",
"202223032175149756673861886485959359246",
"124412925720586162147077837712719354021",
"220986621343607006413256164413016791275",
"183134655446320060839061334116575089796",
"287931524451963760390112130986378870821",
"128900983655311665529089943021168922816",
"236146296843076242859095139366909792498",
"86989127134615259737255253283979996450",
"56633564947681612887473711553171147084",
"181712362383596412660154827477550647141",
"241594388989418701939665953548202592730",
"323840145794233251761303818903147867587",
"136817469819306268117451056389159320954",
"182383955671918882228389868068568761099",
"189921564601598620701379001643939299867",
"36712137212120945657324454686743523664",
"244484663525240862757265689227010956540",
"12313432430805115354695154105776651147",
"172351834934412900656182744412464008044",
"52397734280252346543431381957142144709",
"255190208419252748779243247190404276277",
"287645841918909487494226905072797072555",
"220232132426778140146986970587345969100"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "CCryptoIO::InitCrypto",
"file": "SandboxieTools/ImBox/CryptoIO.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-d20a477f",
"signature_version": "v1",
"digest": {
"length": 2172.0,
"function_hash": "100415652290086271023330284305497260864"
},
"signature_type": "Function"
},
{
"target": {
"file": "SandboxieTools/ImBox/CryptoIO.h"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-dd607e9a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"33272183048757167239564759815458661545",
"174408127556923671116310920431814952384",
"101888688335189779230420381697071223978"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "wWinMain",
"file": "SandboxieTools/ImBox/ImBox.cpp"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-eb75df0b",
"signature_version": "v1",
"digest": {
"length": 2987.0,
"function_hash": "253826204934871573722873923498565708887"
},
"signature_type": "Function"
},
{
"target": {
"file": "SandboxieTools/ImBox/dc/include/volume.h"
},
"deprecated": false,
"source": "https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a",
"id": "CVE-2025-54422-ed69adac",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"290355409925195664399457270738074770818",
"269053878883067501263713395196863478515",
"191367023174346259661589647501673483655",
"76205347229567237894078426587745324364",
"244861788813659979951347579447831795452",
"178020623740987756070273533782066873242",
"19067832450360623969028043521720680861"
]
},
"signature_type": "Line"
}
]
vanir_signatures_modified
"2026-08-12T15:16:41Z"