Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-87601HIGHRace condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2023-28144HIGHKDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involvingEPSS 0.3%CVE-2026-62436MEDIUMgrant-table: version change racing with other operationsEPSS 0.3%CVE-2026-62435MEDIUMgrant-table: version change racing with other operationsEPSS 0.3%CVE-2025-48000HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-24951—A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enEPSS 0.3%CVE-2026-4635MEDIUMPersistent notification timing attack causing server denial of serviceEPSS 0.3%CVE-2025-54105HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-22851MEDIUMFreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)EPSS 0.3%CVE-2026-26206MEDIUMWazuh: API brute-force protection bypass via race condition in login attempt trackingEPSS 0.3%CVE-2023-52553HIGHRace condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2026-44818HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-54108HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-53807HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-43981HIGHAlgernon: Race Condition in handle() shared LStateEPSS 0.3%CVE-2025-49665HIGHWorkspace Broker Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-54114HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-40178MEDIUMajenti.plugin.core has a race conditions in 2FAEPSS 0.3%CVE-2025-12383CRITICALRace Condition allows Bypass of Trust RestrictionsEPSS 0.3%CVE-2025-40569MEDIUMA vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All vEPSS 0.3%