Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-11637MEDIUMTomofun Furbo 360 Audio race conditionEPSS 0.3%CVE-2026-26201HIGHemp3r0r Affected by Concurrent Map Access DoS (panic/crash)EPSS 0.3%CVE-2026-91947HIGHFreeRDP Server before 3.31.0 Use-After-Free via DRDYNVCEPSS 0.3%CVE-2026-82543MEDIUMvastsa FileCodeBox Pickup Limit views.py update_file_usage race conditionEPSS 0.3%CVE-2026-48154MEDIUMGoRest: InMemorySecret2FA race condition allows process crash via concurrent map accessEPSS 0.3%CVE-2023-35361HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2020-25651—A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connectionEPSS 0.3%CVE-2026-59896MEDIUMhono/jsx does not isolate context per request, leading to cross-request data disclosureEPSS 0.3%CVE-2010-5169HIGHRace condition in Online Armor Premium 4.0.0.35 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous EPSS 0.3%CVE-2010-5159HIGHRace condition in Dr.Web Security Space Pro 6.0.0.03100 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute daEPSS 0.3%CVE-2025-45731MEDIUMA group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operaEPSS 0.3%CVE-2026-20867HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20873HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20836HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-32161HIGHWindows Native WiFi Miniport Driver Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-20830HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20808HIGHWindows File Explorer Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-20815HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-51505HIGHAn issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race condition to escalate pEPSS 0.3%CVE-2026-20874HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%