Sandboxie Plus 1.19.0 / Classic 5.74.0 brings an extensive round of security hardening and reliability improvements following an AI-assisted audit of the codebase. We reviewed the findings and addressed all relevant issues identified during the audit. The critical issues were already fixed in the previously released version 1.18.8; this release completes the broader cleanup and introduces additional safeguards throughout the driver and service.

The fixes cover memory handling, request validation, access checks, and synchronization. They address buffer overflows and out-of-bounds reads, unintended disclosure of memory contents, resource leaks, and race conditions or locking errors that could cause crashes and deadlocks. Configuration handling has also been hardened to reject malformed input and prevent bypasses of per-section editing restrictions.

Several corrections improve the enforcement of existing security rules, including IPv4 loopback blocking, firewall range matching, file-path validation, and duplicated-handle access checks. Service operations now apply stricter user and session checks where needed, and desktop launch actions correctly use the calling user’s token. This release also includes the fix allowing users to choose where imported sandboxes are created.

Some of these fixes required minor changes to existing behavior, which may affect compatibility with particular applications or configurations. Please test version 1.19.0 thoroughly with your usual workflows. If you encounter regressions, revert to version 1.18.8 and report the problem so we can investigate. Version 1.18.8 already includes the critical fixes and remains the fallback while these broader changes receive testing.

Download: https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.19.0