Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-32090HIGHWindows Speech Brokered Api Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-34351HIGHWindows TCP/IP Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-54991HIGHWindows USB Print Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-54107HIGHWindows Win32k Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-50378HIGHWindows Key Guard Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-50440HIGHWindows Audio Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-73463MEDIUMSecurity Advisory 0169EPSS 0.2%CVE-2026-27927HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-50667HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-58526HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-64773LOWIn JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limitEPSS 0.2%CVE-2026-50321HIGHWindows USB Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-27918HIGHWindows Shell Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-34334HIGHWindows TCP/IP Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-26167HIGHWindows Push Notifications Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-79014MEDIUMRace condition in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypEPSS 0.2%CVE-2026-78979MEDIUMRace condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypaEPSS 0.2%CVE-2023-28984MEDIUMJunos OS: QFX Series: The PFE may crash when a lot of MAC addresses are being learned and agedEPSS 0.2%CVE-2026-32018LOWOpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write OperationsEPSS 0.2%CVE-2025-13721HIGHRace in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 0.2%