Weaknesses of type CWE-362

1,090 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-28888MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 2EPSS 0.1%CVE-2026-28996MEDIUMA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, EPSS 0.1%CVE-2025-61480HIGHAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofEPSS 0.1%CVE-2025-64118MEDIUMnode-tar vulnerable to race condition leading to uninitialized memory exposureEPSS 0.1%CVE-2026-16082MEDIUMSipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctouEPSS 0.1%CVE-2026-54229HIGHAbrt: chownproblemdir succeeds during active post-create event processing due to inadequate lockingEPSS 0.1%CVE-2026-42487HIGHx86 HVM I/O port list traversalEPSS 0.1%CVE-2026-62437MEDIUMx86: DMs may cause mem leak by IRQ bindingEPSS 0.1%CVE-2026-84607HIGHA race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS EPSS 0.1%CVE-2024-23599HIGHRace condition in Seamless Firmware Updates for some Intel(R) reference platforms may allow a privileged user to potentially enable denial oEPSS 0.1%CVE-2026-0068CRITICALIn createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO coEPSS 0.1%CVE-2026-28926HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.1%CVE-2026-0083CRITICALIn Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privileEPSS 0.1%CVE-2026-16727HIGHConcurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to exeEPSS 0.1%CVE-2026-43693HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.1%CVE-2023-42959HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitraryEPSS 0.1%CVE-2026-32723MEDIUMSandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)EPSS 0.1%CVE-2024-47974MEDIUMRace condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial of service.EPSS 0.1%CVE-2023-41833HIGHA race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege viaEPSS 0.1%CVE-2025-0372MEDIUMConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows alEPSS 0.1%