CVE-2026-114594
Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard Installer
Description
A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3.
INFO
Published Date :
Nov. 9, 2026, 4:15 p.m.
Last Modified :
Nov. 9, 2026, 4:15 p.m.
Remotely Exploit :
No
Source :
SDC
Affected Products
The following products are affected by CVE-2026-114594
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | 634960e2-700d-44e8-9cc5-06f1161e61db |
Solution
- Update Sandisk Dashboard to a patched version.
- Apply vendor patches for the installer.
- Restrict temporary directory access.
- Validate file integrity before execution.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-114594 vulnerability anywhere in the article.