Weaknesses of type CWE-362

1,090 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-48548HIGHIn multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the privacy indicator due to EPSS 0.1%CVE-2025-21101MEDIUMDell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit tEPSS 0.1%CVE-2026-14367LOWI3C IBI work-node free-list data race between ISR and workqueue threadEPSS 0.1%CVE-2026-17654HIGHRace in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicEPSS 0.1%CVE-2025-46284HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to EPSS 0.1%CVE-2022-32613MEDIUMIn vcu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2022-32612MEDIUMIn vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2026-46732MEDIUMDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper SyEPSS 0.1%CVE-2026-46693MEDIUMImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijackingEPSS 0.1%CVE-2025-24493MEDIUMkernel_liteos_a has a race condition vulnerabilityEPSS 0.1%CVE-2024-47968MEDIUMImproper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potentially enable denial oEPSS 0.1%CVE-2022-32621MEDIUMIn isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2026-87467HIGHRace condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary coEPSS 0.1%CVE-2025-20119MEDIUMCisco Application Policy Infrastructure Controller Authenticated Local Denial of Service VulnerabilityEPSS 0.1%CVE-2022-26758HIGHA malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improvEPSS 0.1%CVE-2026-84562MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able to access protected uEPSS 0.1%CVE-2024-0041HIGHIn removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This cEPSS 0.1%CVE-2026-22702MEDIUMvirtualenv Has TOCTOU Vulnerabilities in Directory CreationEPSS 0.1%CVE-2025-48564HIGHIn multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege wiEPSS 0.1%CVE-2025-36934HIGHIn bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could EPSS 0.1%