Weaknesses of type CWE-367

681 results

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: permissão, existência de arquivo) e depois usa o recurso baseado naquela verificação, mas entre os dois momentos outro processo pode mudar o estado do recurso. O atacante explora a janela de tempo para alterar o que foi verificado, contornando a validação.

Example

Um programa verifica se um arquivo existe e tem permissão de leitura, depois o abre para processar. Entre a verificação e a abertura, um atacante pode trocar o arquivo por um link simbólico apontando para um arquivo sensível do sistema. O programa abre o link sem perceber a mudança.

How to mitigate

Use operações atômicas que combinam verificação e uso em uma única chamada de sistema (ex: open() com flags exclusivas, fstat() após abrir arquivo). Em casos de acesso a dados compartilhados, implemente locks ou transações que impeçam alterações entre a validação e o uso do recurso.

CVE-2025-20037MEDIUMTime-of-check time-of-use race condition in firmware for some Intel(R) Converged Security and Management Engine may allow a privileged user EPSS 0.1%CVE-2026-6505MEDIUMThe ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. ThEPSS 0.1%CVE-2026-35357MEDIUMuutils coreutils cp Information Disclosure via Permission Handling RaceEPSS 0.1%CVE-2026-20908MEDIUMTime-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a EPSS 0.1%CVE-2024-43067HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in CameraEPSS 0.1%CVE-2026-54327LOWPi: Race condition in auth.json writes could expose stored credentialsEPSS 0.1%CVE-2026-35354MEDIUMuutils coreutils mv Security Xattr TOCTOU Race in Cross-DeviceEPSS 0.1%CVE-2026-45197LOWGPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSetEPSS 0.1%CVE-2026-91813HIGHFoxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation VulnerabilityEPSS 0.1%CVE-2026-35374MEDIUMuutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race ConditionEPSS 0.1%CVE-2025-64457MEDIUMIn JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race conditionEPSS 0.1%CVE-2022-33257CRITICALTime-of-check time-of-use race condition in CoreEPSS 0.1%CVE-2024-53028HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle NetworksEPSS 0.1%CVE-2024-53032HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS PlatformEPSS 0.1%CVE-2022-33214HIGHMemory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon CEPSS 0.1%CVE-2023-28576MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel DriverEPSS 0.1%CVE-2025-64390HIGHA privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox canEPSS 0.1%CVE-2026-2364HIGHCODESYS Installer TOCTOU Privilege EscalationEPSS 0.1%CVE-2025-22850MEDIUMTime-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an information disclosureEPSS 0.1%CVE-2022-23826LOWA TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race conditiEPSS 0.1%