A time‑of‑check to time‑of‑use race condition in the Sandisk Dashboard installer allows a user with local, authenticated standard privileges to replace a staged installer binary within a user‑writable temporary directory after validation but before execution. By doing so, the attacker can cause the elevated installer process to run attacker‑controlled code, resulting in a local privilege escalation to a high‑integrity administrative context. This flaw is a classic TOCTOU vulnerability that compromises the integrity of the installer’s execution flow.

Sandisk Dashboard installations up to version 5.2.2.3 are vulnerable. The affected product is Sandisk Dashboard, and the critical path involves the installer component that stages binaries in a temporary directory during its acquisition. Users of this product running any unpatched version are at risk.

The CVSS score of 5.4 indicates a medium severity. No EPSS score is available, so exploitation probability is unknown, yet the flaw provides a clear local privilege escalation path. The vulnerability is not listed in CISA’s KEV catalog, implying that no publicly known exploit is documented. Likely attack vector is local, authenticated, requiring a standard user account capable of running the installer. The attacker would exploit the race condition to replace the staged binary before elevation, culminating in execution within an administrative context.