Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-16211LOWallegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race conditionEPSS 0.2%CVE-2026-26074HIGHEVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data raceEPSS 0.2%CVE-2023-6531HIGHKernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uafEPSS 0.2%CVE-2026-10565LOWOpen5GS NGAP Handover gmm-sm.c gmm_state_security_mode race conditionEPSS 0.2%CVE-2024-27020HIGHnetfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()EPSS 0.2%CVE-2024-26307MEDIUMApache Doris: Possible race conditionEPSS 0.2%CVE-2026-6921HIGHRace in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.2%CVE-2023-23039MEDIUMAn issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physEPSS 0.2%CVE-2021-20321—A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OveEPSS 0.2%CVE-2026-32091HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-70582MEDIUMWindows Management Instrumentation Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-40887MEDIUMRace condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticatEPSS 0.2%CVE-2025-30235LOWShearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication atteEPSS 0.2%CVE-2026-74973MEDIUMRace condition, use-after-free in the Graphics componentEPSS 0.2%CVE-2025-31188HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 0.2%CVE-2026-50667HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-58527HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-27927HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-58526HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-50440HIGHWindows Audio Service Elevation of Privilege VulnerabilityEPSS 0.2%