{"id":"CVE-2026-114594","kind":"vulnerability","aliases":["CVE-2026-114594"],"related":[],"title":"Sandisk Dashboard installer race lets local users gain administrator rights","description":"A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3.","summary":"The Sandisk Dashboard installer checks a binary staged in a user-writable temporary folder, then runs it with elevated rights, but a local user can swap the file in between. An authenticated standard user can therefore get code to run as an administrator on the Windows machine.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Sandisk Dashboard","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","sandisk-dashboard","windows"],"not_affected_if":["no-local-standard-users","sandisk-dashboard-not-installed"],"how_to_check":"- Check whether Sandisk Dashboard is installed and its version, which the sources place at `5.2.2.3` or earlier","fix":null,"status":"open","published_at":"2026-11-09T17:17:10+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:28:59+00:00","updated_at":"2026-11-09T17:28:59+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-09T17:28:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Sandisk Dashboard installer race lets local users gain administrator rights","impact":"high","summary":"The Sandisk Dashboard installer checks a binary staged in a user-writable temporary folder, then runs it with elevated rights, but a local user can swap the file in between. An authenticated standard user can therefore get code to run as an administrator on the Windows machine.","audience":"everyone","category":"other","nicknames":[],"who_cares":["sandisk-dashboard","windows"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local standard user gains administrator-level code execution on the machine.","analyst_note":"Check the Sandisk vendor advisory or NVD page for a fixed version and the exact installer behaviour.","how_to_check":"- Check whether Sandisk Dashboard is installed and its version, which the sources place at `5.2.2.3` or earlier\n- unknown for other checks, as the sources do not say","plain_action":"","product_name":"Sandisk Dashboard","needs_analyst":true,"not_affected_if":["sandisk-dashboard-not-installed","no-local-standard-users"],"who_is_affected":"Sandisk Dashboard through version 5.2.2.3 is affected, as the flaw is in its installer. Someone needs a standard account on the machine first, so shared computers are the main concern. The sources do not say whether a patched version exists.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4607,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114594':13A,16A '-2026':12A,15A '5.2.2.3':142C 'administr':9A,67B,134C 'affect':138C 'allow':90C 'attack':121C 'attacker-control':120C 'authent':56B,93C 'binari':30B,102C,123C 'check':28B,76C 'code':62B 'condit':84C 'context':135C 'control':122C 'cve':11A,14A 'dashboard':2A,18A,22B,26B,88C,140C 'directori':109C 'elev':43B,115C 'escal':128C 'execut':113C,118C 'file':52B 'folder':38B 'gain':8A 'get':61B 'high':132C 'high-integr':131C 'instal':3A,27B,89C,100C,116C 'installer-stag':99C 'integr':133C 'issu':137C 'let':5A 'local':6A,47B,92C,126C 'machin':71B 'privileg':127C 'race':4A,83C 'replac':97C 'result':124C 'right':10A,44B 'run':40B,64B 'sandisk':1A,17A,21B,25B,87C,139C 'sandisk-dashboard':20B 'stage':31B,101C 'standard':57B,94C 'swap':50B 'temporari':37B,108C 'therefor':60B 'time':74C,79C 'time-of-check':73C 'time-of-us':78C 'toctou':82C 'use':81C 'user':7A,35B,48B,58B,95C,106C 'user-writ':34B,105C 'valid':111C 'window':23B,70B 'writabl':36B,107C","nicknames":[],"mitigations":[],"who_affected":"Sandisk Dashboard through version 5.2.2.3 is affected, as the flaw is in its installer. Someone needs a standard account on the machine first, so shared computers are the main concern. The sources do not say whether a patched version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["dashboard","sandiskdashboard"],"ptokens":["dashboard","sandisk"],"labels":["medium","other","sandiskdashboard","vendor","windows"],"campaign_type":null,"search_a":"'-114594':13A,16A '-2026':12A,15A 'administr':9A 'cve':11A,14A 'dashboard':2A,18A 'gain':8A 'instal':3A 'let':5A 'local':6A 'race':4A 'right':10A 'sandisk':1A,17A 'user':7A","search_b":"'administr':67B 'authent':56B 'binari':30B 'check':28B 'code':62B 'dashboard':22B,26B 'elev':43B 'file':52B 'folder':38B 'get':61B 'instal':27B 'local':47B 'machin':71B 'right':44B 'run':40B,64B 'sandisk':21B,25B 'sandisk-dashboard':20B 'stage':31B 'standard':57B 'swap':50B 'temporari':37B 'therefor':60B 'user':35B,48B,58B 'user-writ':34B 'window':23B,70B 'writabl':36B","search_c":"'5.2.2.3':142C 'administr':134C 'affect':138C 'allow':90C 'attack':121C 'attacker-control':120C 'authent':93C 'binari':102C,123C 'check':76C 'condit':84C 'context':135C 'control':122C 'dashboard':88C,140C 'directori':109C 'elev':115C 'escal':128C 'execut':113C,118C 'high':132C 'high-integr':131C 'instal':89C,100C,116C 'installer-stag':99C 'integr':133C 'issu':137C 'local':92C,126C 'privileg':127C 'race':83C 'replac':97C 'result':124C 'sandisk':87C,139C 'stage':101C 'standard':94C 'temporari':108C 'time':74C,79C 'time-of-check':73C 'time-of-us':78C 'toctou':82C 'use':81C 'user':95C,106C 'user-writ':105C 'valid':111C 'writabl':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"634960e2-700d-44e8-9cc5-06f1161e61db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114594","severity":null,"published_at":"2026-11-09T17:17:10+00:00","modified_at":"2026-11-09T17:17:10+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}