{"id":"CVE-2026-111521","kind":"vulnerability","aliases":["CVE-2026-111521"],"related":[],"title":"Dell Display and Peripheral Manager: race condition lets local user run code","description":"Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.","summary":"Dell Display and Peripheral Manager for Windows has a time-of-check to time-of-use race condition in versions before 2.4.0.17. A low-privileged local user could exploit it to execute code.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell","endpoint","vendor","windows"],"not_affected_if":["already-patched","app-not-installed"],"how_to_check":"- Open the installed app version in Dell Display and Peripheral Manager on Windows and compare it with `2.4.0.17`","fix":"- Dell Display and Peripheral Manager (Windows): `2.4.0.17` or later","status":"open","published_at":"2026-11-11T22:17:10+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:33:58+00:00","updated_at":"2026-11-11T22:33:58+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:33:58Z","model":"claude-haiku-5-5","output":{"fix":"- Dell Display and Peripheral Manager (Windows): `2.4.0.17` or later","reach":"local","title":"Dell Display and Peripheral Manager: race condition lets local user run code","impact":"high","summary":"Dell Display and Peripheral Manager for Windows has a time-of-check to time-of-use race condition in versions before 2.4.0.17. A low-privileged local user could exploit it to execute code.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","dell","endpoint"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"code runs with elevated privileges on the local machine","analyst_note":"","how_to_check":"- Open the installed app version in Dell Display and Peripheral Manager on Windows and compare it with `2.4.0.17`\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["already-patched","app-not-installed"],"who_is_affected":"Windows machines with Dell Display and Peripheral Manager installed before version 2.4.0.17 are exposed. The attacker needs local access and a low-privileged account on that machine. Machines without the app, or already on 2.4.0.17 or later, are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4570,"output_tokens":474,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111521':15A,18A '-2026':14A,17A '2.4.0.17':46B,69C 'access':89C 'attack':86C 'check':35B,75C 'code':12A,58B,97C 'condit':7A,42B,81C 'contain':70C 'could':53B,90C 'cve':13A,16A 'ddpm':64C 'dell':1A,19B,23B,59C 'display':2A,24B,60C 'endpoint':20B 'execut':57B,98C 'exploit':54B,92C 'lead':95C 'let':8A 'local':9A,51B,88C 'low':49B,84C 'low-privileg':48B 'manag':5A,27B,63C 'peripher':4A,26B,62C 'potenti':91C 'prior':67C 'privileg':50B,85C 'race':6A,41B 'run':11A 'time':33B,38B,73C,77C 'time-of-check':32B,72C 'time-of-us':37B,76C 'toctou':80C 'use':40B,79C 'user':10A,52B 'vendor':21B 'version':44B,66C 'vulner':82C,94C 'window':22B,29B,65C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with Dell Display and Peripheral Manager installed before version 2.4.0.17 are exposed. The attacker needs local access and a low-privileged account on that machine. Machines without the app, or already on 2.4.0.17 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dell","endpoint","high","vendor","windows"],"campaign_type":null,"search_a":"'-111521':15A,18A '-2026':14A,17A 'code':12A 'condit':7A 'cve':13A,16A 'dell':1A 'display':2A 'let':8A 'local':9A 'manag':5A 'peripher':4A 'race':6A 'run':11A 'user':10A","search_b":"'2.4.0.17':46B 'check':35B 'code':58B 'condit':42B 'could':53B 'dell':19B,23B 'display':24B 'endpoint':20B 'execut':57B 'exploit':54B 'local':51B 'low':49B 'low-privileg':48B 'manag':27B 'peripher':26B 'privileg':50B 'race':41B 'time':33B,38B 'time-of-check':32B 'time-of-us':37B 'use':40B 'user':52B 'vendor':21B 'version':44B 'window':22B,29B","search_c":"'2.4.0.17':69C 'access':89C 'attack':86C 'check':75C 'code':97C 'condit':81C 'contain':70C 'could':90C 'ddpm':64C 'dell':59C 'display':60C 'execut':98C 'exploit':92C 'lead':95C 'local':88C 'low':84C 'manag':63C 'peripher':62C 'potenti':91C 'prior':67C 'privileg':85C 'time':73C,77C 'time-of-check':72C 'time-of-us':76C 'toctou':80C 'use':79C 'version':66C 'vulner':82C,94C 'window':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111521","severity":null,"published_at":"2026-11-11T22:17:10+00:00","modified_at":"2026-11-11T22:17:10+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}