Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-54973MEDIUMA concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyEPSS 0.3%CVE-2026-42978HIGHWindows Push Notifications Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-121963HIGHFreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel CloseEPSS 0.3%CVE-2026-20853HIGHWindows WalletService Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-64658HIGHWindows File Explorer Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-15630MEDIUMDevice Provisioning Race Condition in TP-Link Omada Adoption WorkflowEPSS 0.3%CVE-2025-11637MEDIUMTomofun Furbo 360 Audio race conditionEPSS 0.3%CVE-2025-66419HIGHMaxKB vulnerable to privilege escalation through sandbox bypassEPSS 0.3%CVE-2026-112669MEDIUMA race condition was addressed with improved state handling. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden GateEPSS 0.3%CVE-2026-106201HIGHRace condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2010-5181HIGHRace condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangeroEPSS 0.3%CVE-2026-64024CRITICALtcp: fix stale per-CPU tcp_tw_isn leak enabling ISN predictionEPSS 0.3%CVE-2025-23259MEDIUMNVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause infoEPSS 0.3%CVE-2026-28924HIGHA race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, mEPSS 0.3%CVE-2010-5175MEDIUMRace condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous codeEPSS 0.3%CVE-2026-121961HIGHFreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker RaceEPSS 0.3%CVE-2026-97791HIGHApache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requestsEPSS 0.3%CVE-2026-106238HIGHRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.3%CVE-2026-53086CRITICALnet: bcmgenet: fix racing timeout handlerEPSS 0.3%CVE-2026-20924HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.3%