CVE-2026-114594
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
26/100
Published: 2026-11-09
Modified: 2026-11-12
First seen: 2026-11-09
Status: active
Attack Surface
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
Active
S:
X
AT:
Present
VC:
High
VI:
High
VA:
High
Description
A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3.
Weakness Classification (2)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Sandisk | Sandisk Dashboard | 0 |
| Sandisk | Sandisk Dashboard | 0 |