Weaknesses of type CWE-367

799 results

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: permissão, existência de arquivo) e depois usa o recurso baseado naquela verificação, mas entre os dois momentos outro processo pode mudar o estado do recurso. O atacante explora a janela de tempo para alterar o que foi verificado, contornando a validação.

Example

Um programa verifica se um arquivo existe e tem permissão de leitura, depois o abre para processar. Entre a verificação e a abertura, um atacante pode trocar o arquivo por um link simbólico apontando para um arquivo sensível do sistema. O programa abre o link sem perceber a mudança.

How to mitigate

Use operações atômicas que combinam verificação e uso em uma única chamada de sistema (ex: open() com flags exclusivas, fstat() após abrir arquivo). Em casos de acesso a dados compartilhados, implemente locks ou transações que impeçam alterações entre a validação e o uso do recurso.

CVE-2026-21523HIGHGitHub Copilot and Visual Studio Code Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-29062HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.7%CVE-2023-38041HIGHA logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flEPSS 0.7%CVE-2022-23029—On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when aEPSS 0.7%CVE-2026-37531CRITICALAGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367EPSS 0.7%CVE-2022-23181—Local privilege escalation with FileStoreEPSS 0.7%CVE-2025-49730HIGHMicrosoft Windows QoS Scheduler Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2019-11774—Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop EPSS 0.7%CVE-2022-26387HIGHWhen installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underEPSS 0.7%CVE-2024-30471MEDIUMApache StreamPipes: Potential creation of multiple identical accountsEPSS 0.7%CVE-2022-22753HIGHA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrarEPSS 0.7%CVE-2026-123835MEDIUMIn JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionEPSS 0.6%CVE-2023-38141HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-3464HIGHA race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leadinEPSS 0.6%CVE-2026-78319CRITICALTOCTOU Vulnerability in file exchangeEPSS 0.6%CVE-2024-27297MEDIUMNix Corruption of fixed-output derivationsEPSS 0.6%CVE-2022-34830HIGHAn Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operatiEPSS 0.6%CVE-2026-66314MEDIUMMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.6%CVE-2026-82761CRITICALMagic link single-use tokens replayable via TOCTOU race in AshAuthenticationEPSS 0.6%CVE-2026-41651HIGHPackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as rootEPSS 0.5%