CVE-2025-64721

CVE-2025-64721 is a critical heap overflow vulnerability affecting Sandboxie-Plus and Sandboxie versions 1.16.6 and below. This flaw allows sandboxed processes to execute arbitrary code as SYSTEM due to an integer overflow in the SbieSvc.exe service's RC4Crypt handler, which leads to an undersized buffer allocation. With a CVSS score of 10.0, this vulnerability is easily exploitable over the network with low attack complexity, resulting in complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion, and immediate patching to version 1.16.7 or higher is strongly recommended.