Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-53517HIGHBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family ForkingEPSS 0.4%CVE-2026-88174HIGHWindows Deployment Services Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-59455MEDIUMIn JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionEPSS 0.4%CVE-2025-54115HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-45300HIGHBypassing promo code limitations with race conditionsEPSS 0.4%CVE-2022-42930HIGHIf two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This EPSS 0.4%CVE-2026-55784HIGHfree5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIEPSS 0.4%CVE-2025-7954MEDIUMRace Condition in Shopware Voucher SubmissionEPSS 0.4%CVE-2020-28049MEDIUMAn issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unpEPSS 0.4%CVE-2026-47620MEDIUMNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initializationEPSS 0.4%CVE-2026-78906HIGHRace condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the EPSS 0.4%CVE-2026-43199HIGHnet/mlx5e: Fix "scheduling while atomic" in IPsec MAC address queryEPSS 0.4%CVE-2026-85704MEDIUMramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race conditionEPSS 0.4%CVE-2024-48069CRITICALA vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files anEPSS 0.4%CVE-2026-28986HIGHA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.4%CVE-2022-24540HIGHWindows ALPC Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-31450HIGHext4: publish jinode after initializationEPSS 0.4%CVE-2026-54999HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-48880MEDIUMFreeScout has Race Condition When Deleting UsersEPSS 0.4%CVE-2026-92050CRITICALSandbox escape due to race condition in the XPConnect componentEPSS 0.4%