{"id":"CVE-2025-54422","summary":"Sandboxie exposes encrypted sandbox key during password change","details":"Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory, exposing them to potential interception. The vulnerability is particularly severe during password modification operations, where both old and new passwords are passed as plaintext command-line arguments to the Imbox process without any encryption or obfuscation. This implementation flaw allows any process within the user session, including unprivileged processes, to retrieve these sensitive credentials by reading the command-line arguments, thereby bypassing standard privilege requirements and creating a significant security risk. This is fixed in version 1.16.2.","aliases":["GHSA-jp7r-vgv9-43p7"],"modified":"2026-08-12T15:16:41.563658Z","published":"2025-07-29T12:47:50.414Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54422.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-312","CWE-322","CWE-497","CWE-522"]},"references":[{"type":"WEB","url":"https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.16.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54422.json"},{"type":"ADVISORY","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-jp7r-vgv9-43p7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54422"},{"type":"FIX","url":"https://github.com/sandboxie-plus/Sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sandboxie-plus/sandboxie","events":[{"introduced":"0"},{"fixed":"f2cb3aec9806237fa8d742015aca54060381d06b"},{"fixed":"d107d5743880da28e782c1771b5246b2a512989a"}],"database_specific":{"cpe":"cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.16.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.16.1","v1.16.0","v1.15.12","v1.15.10","v1.15.9","v1.15.8","v1.15.7","v1.15.6","v1.15.5","v1.15.4","v1.15.3","v1.15.2","v1.15.1","v1.15.0","v1.14.10","v1.14.9","v1.14.8","v1.14.7","v1.14.6","v1.14.5","v1.14.4","v1.14.3","v1.14.1","v1.14.0","v1.13.7","v1.13.6","v1.13.5","v1.13.4","v1.13.3","v1.13.2","v1.13.1","v1.13.0","v1.12.9","v1.12.8","v1.12.7","v1.12.6","v1.12.5","v1.12.4","v1.12.3","v1.12.2","v1.12.1","v1.12.0","v1.11.4","v1.11.3","v1.11.2","v1.11.1","v1.11.0","v1.10.5","v1.10.4","v1.10.3","v1.10.2","v1.10.1","v1.9.8","v1.9.7","v1.9.6","v1.9.4","v1.9.3","v1.9.1","v1.9.0","v1.8.4","v1.8.3","v1.8.2a","v1.8.2","v1.8.1","v1.8.0","v1.7.2","v1.7.1","v1.7.0","v1.6.7","v1.6.6","v1.6.5","v1.6.4","v1.6.3","v1.6.2b","v1.6.1b","v1.6.1a","v1.6.1","v1.6.0","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.2","v1.4.1","v1.4.0","v1.3.5","1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.9","v1.2.8","v1.2.7","v1.2.6","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.1.3","v1.1.2","1.1.0","1.0.22","1.0.20","1.0.19","1.0.18","1.0.17","1.0.16","1.0.15","1.0.14","1.0.13","1.0.12","1.0.11","1.0.10","1.0.8","1.0.6","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0.0","0.9.8d","0.9.8c","0.9.8","0.9.7e","0.9.7d","0.9.7c","0.9.7b","0.9.7","0.9.6","0.9.5","0.9.4","0.9.3","0.9.2","0.9.1","0.9.0a","0.8.8","0.8.7b","0.8.7","0.8.6","0.8.5","0.8.2","0.8.0","0.8.1","0.7.5","0.7.4","0.7.3","0.7.2","0.7.1","0.7.0","0.6.7","0.6.5","0.6.0","0.5.5","v0.5.4d","v0.5.4c","v0.5.4b","v0.5.4","v0.5.3b","v0.5.3a","v0.5.2","v0.5.1","v0.5.0","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","v0.3.5","v0.3","v0.2.2","v0.2.1","v0.2","v0.1","v5.40.1","v5.40"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54422.json","vanir_signatures_modified":"2026-08-12T15:16:41Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["107596943462797987190773672731711448240","36927308367978223141023361544943100949","164117099482252342607267632333170597594","149855338126108501608869062982236270801","137868712313279012343223119627007908219","223512307135820371898845907235741051056","218013103332846008664097000510183394717","163813335660178238750344319234667213560","127000027502188248335950934621874079915","273032990415983285048881485875431557155","311950702866863729650236766568167682348","277421942705820476792691831416885210211","215817338755772175068110580310671879318","313416105896097772106045231472452974668","59674159771944208298251917528058416372","321169459558632143881048241260473376362","67073996470819091862326087398036074279","37774079811945896285896366474200949048","19167622922004138633086032796866044724","151244943894558128437521011089160680131","67414408025240361268915519838034467818","299223446216045818966025874376255542986","257232157448061185377146100631499240813","193297489990940967773432708758067644763","245245044932148994433307309761009612487","286622192838359676242016125916245910854","35678434012213227113127275490410984922","234371997725731131799791885782341259933","286683095405257156496394280304936456319","72998799481584944837210762215211220220","107627431427635307093949615975720283870","225723474389109254183542623060291897301","105233927634036777918191323697314857261","151033809121964705153500027669742554046","296934734299628818997904211512494051188","153350782283504605617261536102768294868","227433186673775813407775435977511120475","22812784501806129801496387069290210716","154639645200663185660943346404200701611","13387859191946338000340187574181267498","4580283267622057503328574977088248320"],"threshold":0.9},"id":"CVE-2025-54422-1064bc52","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/ImBox.cpp"}},{"target":{"file":"SandboxieTools/ImBox/CryptoIO.cpp"},"deprecated":false,"digest":{"line_hashes":["52146049766935005291308756727341359907","280447330682009747664996783129400064511","1498237105958974054093785587914565419","235863013048890752467746092569856446009","237607440259576842261579790405871996926","48311048942869431758774511888246078084","151634580385964028106972279576267552837","223934880482722629425553747828715574628","57201813560539026766664952878424141605","107575197191955646042792108398486042781","183846710621077454668952472628237970380","274688941380799618803847745881928140490","37213391183412405438533644426940472383","27002421361226727311622847876702375999","224919286644988493862804173951997304549","252171407474546281440753909486192786791","141514948725839342969020868357387179064"],"threshold":0.9},"id":"CVE-2025-54422-1ea35048","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a"},{"target":{"file":"SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp","function":"COptionsWindow::OnSetPassword"},"deprecated":false,"digest":{"function_hash":"154337660191376822850110220252680709480","length":759},"id":"CVE-2025-54422-2443ea6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a"},{"id":"CVE-2025-54422-25b41e49","signature_type":"Function","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"Sandboxie/core/svc/MountManager.cpp","function":"MountManager::MountImDisk"},"deprecated":false,"digest":{"length":4017,"function_hash":"251617150705950962245243230331125096932"}},{"target":{"file":"SandboxieTools/ImBox/ImBox.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["292900611042214047034468125085358320696"]},"id":"CVE-2025-54422-2d8105b8","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a"},{"source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/ImDiskIO.h"},"deprecated":false,"digest":{"line_hashes":["190419815737865675459010634286279347334","96091118314099426757323310118471990817","178264645807385888671880582572979499506","305035234927460296976322939201693334890","95622105515504691444689704255639476073","207551433699708085518588208557249578982","201229045399732496886684758133031593399","176638233021360148520760837131501202833","138546823720701520785230211108689096812","53368633372313622757546112882130336071"],"threshold":0.9},"id":"CVE-2025-54422-42c2abc3","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-54422-4da3e889","signature_type":"Function","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/ImDiskIO.cpp","function":"CImDiskIO::DoComm"},"deprecated":false,"digest":{"function_hash":"298579605860088591166069457711630859941","length":3238}},{"source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/ImDiskIO.cpp","function":"CImDiskIO::CImDiskIO"},"deprecated":false,"digest":{"function_hash":"69735180894294478631421687835415941726","length":349},"id":"CVE-2025-54422-5c923017","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/ImDiskIO.cpp"},"deprecated":false,"digest":{"line_hashes":["50294588361685204381783527240798381159","48360497710768122434773291971590747504","253919913915184357960132686621445170923","136144661077024105070499637245936039469","151541201155442042036145121588017921065","35432452369369344386600576454840074941","28607795908139409291646994276804759533","111748415259583425599878147133663358591","234714710353698074475497780289562561191","323272670099240914790075075619085738605","293033848902004105130542610447795783778","221913792515329460414472619397896719941","262279748956083850760757077011673620361","292913425112462242691324323574899434276","274791678097340319310216914162572999060","328262626929815748766021423031715787380","21241412127914815800879950297472493526","240867655781794941347880150967887571583","11099198955356318835239076661419667611","124809131347387971611166867872194679471","265688325961729347528332771535924903365","164959199293098102007397654790458929912","308481846473367282113070661439209269536","59734888147646533118227288682159396853","317593993066366776895455215989119800295","219198898372106417068678894555869864873"],"threshold":0.9},"id":"CVE-2025-54422-86207091","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["300499377449823686518448867478904119043","38491642583971068891706233184382379491","169698109674763615695932000159482693693","19181795151307084579423808245492342060"],"threshold":0.9},"id":"CVE-2025-54422-88eec52a","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"Sandboxie/core/svc/MountManager.h"}},{"deprecated":false,"digest":{"line_hashes":["159988019053995777817094951608459066888","191542905507526994408085354610470697449","132443537786361749480467199737746018673","181576697987492944196909536148288069512","333070986558113108707321739815478173704","313205476466854826960556082473460813475"],"threshold":0.9},"id":"CVE-2025-54422-8c3789a6","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxiePlus/QSbieAPI/SbieAPI.cpp"}},{"digest":{"line_hashes":["46217157095509700578964413494500972199","5171389671263113874737310663230147434","215311682293791111453568375783999925763","202333463056745869017843881658081465477","238032855799394335854187654636115008668","144376468697401184760354275852750424181","338857444470467591002244365204523812649","121932417188627585769925134268137454780","316217150575257445648432500949543522043","117265876126853291569265503675865942354"],"threshold":0.9},"id":"CVE-2025-54422-8fc1b3da","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxiePlus/SandMan/Windows/OptionsGeneral.cpp"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/ImDiskIO.cpp","function":"CImDiskIO_Thread"},"deprecated":false,"digest":{"function_hash":"265135607476577513090699740856151344132","length":2441},"id":"CVE-2025-54422-931da63d"},{"signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxiePlus/QSbieAPI/SbieAPI.h"},"deprecated":false,"digest":{"line_hashes":["181171300181348237416338175247908797606","269767340215719360080557904807549756743","113560951840075170522731579153543641390"],"threshold":0.9},"id":"CVE-2025-54422-a0eae131","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"240155620713877872693233101120024146720","length":474},"id":"CVE-2025-54422-a5f588f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"function":"CCryptoIO::CCryptoIO","file":"SandboxieTools/ImBox/CryptoIO.cpp"}},{"deprecated":false,"digest":{"line_hashes":["4591696884550544129537039287352741818","210220016368881447480641044959445046270","101858736178594181241036836564234452860","148226282933439386781274527244341018994","299349114178604388439355137073424463344","73488665204818917915342558636085968379","1232452297849127417884521436084602607","105983820239055732708615371184540323746","250524123005953931591036518892714895661","307954320075102492859637195146934920995","157423464146358725529200555183604645121","44378695721078967567310337669469532076","191120793205313038855614452178039403255","237889297024340361193666743900476318604","339712600949665911826401659821573251484","229998165569832840464055174503690509352","231599542129224357174869863838336445998","77296664379332022653860196299573052333","34810098804202341114210462753927425795","322169826085252865540576298918542467150","164084704225884304947079653778352301379","216143028468003110021205979287316357673","172907888618816707934972333671705537468","211269541379210776424564020047722325234","108325000287818703992249235011224726814","259646749356058021572412373880900727770","76789856777739344315209566078723738427","189951623631120977011495521721550055457","101041998887282370855461816519322580183","241074437516513066348388334179397987371","138406608895418833341380878149280496283","181644400804937470992496160570124978804","127438064382839725167389690525422665519","172931032344331080381230338300702523847","202223032175149756673861886485959359246","124412925720586162147077837712719354021","220986621343607006413256164413016791275","183134655446320060839061334116575089796","287931524451963760390112130986378870821","128900983655311665529089943021168922816","236146296843076242859095139366909792498","86989127134615259737255253283979996450","56633564947681612887473711553171147084","181712362383596412660154827477550647141","241594388989418701939665953548202592730","323840145794233251761303818903147867587","136817469819306268117451056389159320954","182383955671918882228389868068568761099","189921564601598620701379001643939299867","36712137212120945657324454686743523664","244484663525240862757265689227010956540","12313432430805115354695154105776651147","172351834934412900656182744412464008044","52397734280252346543431381957142144709","255190208419252748779243247190404276277","287645841918909487494226905072797072555","220232132426778140146986970587345969100"],"threshold":0.9},"id":"CVE-2025-54422-c379b60e","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"Sandboxie/core/svc/MountManager.cpp"}},{"deprecated":false,"digest":{"function_hash":"100415652290086271023330284305497260864","length":2172},"id":"CVE-2025-54422-d20a477f","signature_type":"Function","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/CryptoIO.cpp","function":"CCryptoIO::InitCrypto"}},{"deprecated":false,"digest":{"line_hashes":["33272183048757167239564759815458661545","174408127556923671116310920431814952384","101888688335189779230420381697071223978"],"threshold":0.9},"id":"CVE-2025-54422-dd607e9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/CryptoIO.h"}},{"signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/ImBox.cpp","function":"wWinMain"},"deprecated":false,"digest":{"function_hash":"253826204934871573722873923498565708887","length":2987},"id":"CVE-2025-54422-eb75df0b","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/sandboxie-plus/sandboxie/commit/d107d5743880da28e782c1771b5246b2a512989a","target":{"file":"SandboxieTools/ImBox/dc/include/volume.h"},"deprecated":false,"digest":{"line_hashes":["290355409925195664399457270738074770818","269053878883067501263713395196863478515","191367023174346259661589647501673483655","76205347229567237894078426587745324364","244861788813659979951347579447831795452","178020623740987756070273533782066873242","19067832450360623969028043521720680861"],"threshold":0.9},"id":"CVE-2025-54422-ed69adac","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}