CVE-2026-114594 PUBLISHED

Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard Installer

Assigner: SDC
Reserved: 21.10.2026 Published: 09.11.2026 Updated: 09.11.2026

A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 5.4

Product Status

Vendor Sandisk
Product Sandisk Dashboard
Versions Default: unaffected
  • affected from 0 to 5.2.2.3 (incl.)

Credits

  • Johan Francsics finder

References

Problem Types

  • CWE-367 Time-of-check time-of-use (TOCTOU) race condition CWE
  • CWE-379 Creation of temporary file in directory with insecure permissions CWE