Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-5890HIGHRace in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from processEPSS 0.2%CVE-2025-48753LOWIn the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.EPSS 0.2%CVE-2026-13882CRITICALRace in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perforEPSS 0.2%CVE-2026-58543MEDIUMUniversal Print Management Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2020-19824HIGHAn issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c parameter.EPSS 0.2%CVE-2025-10778LOWSmartstore Gift Voucher confirm race conditionEPSS 0.2%CVE-2026-15119HIGHRace in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentiaEPSS 0.2%CVE-2025-46613HIGHOpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frEPSS 0.2%CVE-2026-70640HIGHllama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cppEPSS 0.2%CVE-2026-79094MEDIUMRace condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a craftEPSS 0.2%CVE-2025-62219HIGHMicrosoft Wireless Provisioning System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-62218HIGHMicrosoft Wireless Provisioning System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2019-3837MEDIUMIt was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threEPSS 0.2%CVE-2022-42791HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrarEPSS 0.2%CVE-2026-84522MEDIUMA race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access senEPSS 0.2%CVE-2022-27481—A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALAEPSS 0.2%CVE-2026-82258MEDIUMSvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchEPSS 0.2%CVE-2022-1195—A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilegEPSS 0.2%CVE-2025-13012HIGHRace condition in the Graphics componentEPSS 0.2%CVE-2026-21221HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.2%