Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2020-16123MEDIUMBypass of snapd pulseaudio restrictionsEPSS 0.3%CVE-2026-20853HIGHWindows WalletService Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-24857MEDIUMRace condition vulnerability in Linux kernel bluetooth in conn_info_{min,max}_age_set()EPSS 0.3%CVE-2022-48613—Race condition vulnerability in the kernel module. Successful exploitation of this vulnerability may cause variable values to be read with tEPSS 0.3%CVE-2026-33872HIGHelixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race ConditionEPSS 0.3%CVE-2025-3608MEDIUMRace condition in nsHttpTransaction could lead to memory corruptionEPSS 0.3%CVE-2025-54973MEDIUMA concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyEPSS 0.3%CVE-2024-7598LOWNetwork restriction bypass via race condition during namespace terminationEPSS 0.3%CVE-2025-64658HIGHWindows File Explorer Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-3567MEDIUMLinux Kernel IPv6 inet6_dgram_ops race conditionEPSS 0.3%CVE-2025-66419HIGHMaxKB vulnerable to privilege escalation through sandbox bypassEPSS 0.3%CVE-2022-45885HIGHAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-aEPSS 0.3%CVE-2010-5181HIGHRace condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangeroEPSS 0.3%CVE-2026-20918HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20924HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20877HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2010-5175MEDIUMRace condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous codeEPSS 0.3%CVE-2026-28924HIGHA race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, mEPSS 0.3%CVE-2026-20826HIGHTablet Windows User Interface (TWINUI) Subsystem Information Disclosure VulnerabilityEPSS 0.3%CVE-2026-78906HIGHRace condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the EPSS 0.3%