Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-12472HIGHRemote Code Execution in Looker due to Improperly Validated Directory DeletionEPSS 0.3%CVE-2024-20007HIGHIn mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no aEPSS 0.3%CVE-2025-43304HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. AEPSS 0.3%CVE-2026-90506LOWvvbbnn00 WARP-Clash-API Save Account Job race conditionEPSS 0.3%CVE-2026-90505LOWvvbbnn00 WARP-Clash-API doUpdateLicenseKey race conditionEPSS 0.3%CVE-2025-59195HIGHWindows Graphics Component Denial of Service VulnerabilityEPSS 0.3%CVE-2025-62217HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-64661HIGHWindows Shell Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-59216HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2022-41848MEDIUMdrivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proxEPSS 0.2%CVE-2025-62469HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-59220HIGHWindows Bluetooth Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-34368MEDIUMAVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceEPSS 0.2%CVE-2025-59508HIGHWindows Speech Recognition Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-3886MEDIUMCatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race ConditionEPSS 0.2%CVE-2025-49690HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2012-0953MEDIUMKernel heap contents leak race in ioctl handlerEPSS 0.2%CVE-2025-59506HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-5890HIGHRace in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from processEPSS 0.2%CVE-2025-62573HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.2%