Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-114594 EUVD-2026-120089GHSA-2j67-8pgp-xfx4

Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard Installer

Published Nov 9, 2026 · Updated Nov 12, 2026 · Assigned by SDC

Description

A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3.

Affected products

VendorProductAffectedFixed
Sandisk Sandisk Dashboard ≤ 5.2.2.3 —

References