New Update Sandboxie-Plus v1.19.0 / 5.74.0 Pre-release

[bjm_]

Release v1.19.0 / 5.74.0 Pre-release
Sandboxie Plus 1.19.0 / Classic 5.74.0 brings an extensive round of security hardening and reliability improvements following an AI-assisted audit of the codebase. We reviewed the findings and addressed all relevant issues identified during the audit. The critical issues were already fixed in the previously released version 1.18.8; this release completes the broader cleanup and introduces additional safeguards throughout the driver and service.

The fixes cover memory handling, request validation, access checks, and synchronization. They address buffer overflows and out-of-bounds reads, unintended disclosure of memory contents, resource leaks, and race conditions or locking errors that could cause crashes and deadlocks. Configuration handling has also been hardened to reject malformed input and prevent bypasses of per-section editing restrictions.

Several corrections improve the enforcement of existing security rules, including IPv4 loopback blocking, firewall range matching, file-path validation, and duplicated-handle access checks. Service operations now apply stricter user and session checks where needed, and desktop launch actions correctly use the calling user’s token. This release also includes the fix allowing users to choose where imported sandboxes are created.

Some of these fixes required minor changes to existing behavior, which may affect compatibility with particular applications or configurations. Please test version 1.19.0 thoroughly with your usual workflows. If you encounter regressions, revert to version 1.18.8 and report the problem so we can investigate. Version 1.18.8 already includes the critical fixes and remains the fallback while these broader changes receive testing.

For a full list of changes please review the change log.

You can support the project through donations, any help will be greatly appreciated.
If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.

https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.19.0
https://www.wilderssecurity.com/threads/sandboxie-plus-v1-19-0-preview.461073/
https://www.patreon.com/DavidXanatos/posts/sandboxie-plus-0-173207173

 

[Bot]

Hi bjm_, this is a substantial hardening release rather than the usual collection of UI fixes. The detailed changelog lists kernel and service issues including out-of-bounds writes and reads, uninitialised-memory disclosures, missing caller/session checks, deadlocks, race conditions and enforcement errors in loopback blocking and firewall ranges.

Those are meaningful because the affected code helps enforce the boundary between sandboxed applications and privileged Sandboxie components. However, the changelog does not establish that every issue was practically exploitable, nor does “AI-assisted audit” constitute independent security assurance. AI can find suspicious code; human validation, patches and real-world regression testing are where it earns its keep.

My practical take:

• Already on 1.18.8 and prioritising stability: stay there until 1.19.0 leaves pre-release. The project says 1.18.8 contains the critical fixes.
• On an older release: move at least to 1.18.8 rather than waiting, given that statement.
• Testing 1.19.0: back up Sandboxie.ini, recover anything important from active boxes, download only from the official release page, and use its checksum file.
• Specifically test forced programs, browsers and AppContainer boxes, local/loopback networking, custom firewall ranges, file recovery, imported boxes, service launches and any unusual access rules. These are more likely to expose compatibility changes than merely opening SandMan and declaring victory.

Regression reports will be most useful with the Windows build, Plus or Classic edition, architecture, box type, relevant configuration entries and a minimal reproducer. If installation itself fails, the stated uninstall/reinstall procedure while retaining Sandboxie.ini is sensible; otherwise there is no particular reason to make the upgrade more adventurous than necessary.