Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-2319HIGHRace in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures anEPSS 0.2%CVE-2026-13874MEDIUMRace in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from procEPSS 0.2%CVE-2026-69792MEDIUMWindows Win32K Security Feature Bypass VulnerabilityEPSS 0.2%CVE-2026-69710HIGHWindows Hello Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-39880MEDIUMRemnawave Backend has a race condition in HWID device limit allows bypassing max devicesEPSS 0.2%CVE-2025-59577MEDIUMWordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition VulnerabilityEPSS 0.2%CVE-2025-24808MEDIUMDiscourse has race condition when adding users to a group DMEPSS 0.2%CVE-2026-69448HIGHWindows Bluetooth Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-67505HIGHRace condition in the Okta Java SDKEPSS 0.2%CVE-2026-85892HIGHMicrosoft Edge (Chromium-based) Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-69385HIGHWindows TCP/IP Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-69799HIGHWindows Hello Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-69398HIGHWindows Bluetooth Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-69441HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-50066HIGHmm/mremap: fix move_normal_pmd/retract_page_tables raceEPSS 0.2%CVE-2026-23671HIGHWindows Bluetooth RFCOM Protocol Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-24861LOWRace condition vulnerability in Linux kernel media/xc4000 xc4000_get_frequency()EPSS 0.2%CVE-2026-24296HIGHWindows Device Association Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2022-26765MEDIUMA race condition was addressed with improved state handling. This issue is fixed in watchOS 8.6, tvOS 15.5, macOS Monterey 12.4, iOS 15.5 anEPSS 0.2%CVE-2022-42803HIGHA race condition was addressed with improved locking. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watcEPSS 0.2%