Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2022-24951—A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enEPSS 0.3%CVE-2025-54105HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-22851MEDIUMFreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)EPSS 0.3%CVE-2026-7432HIGHA race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMEPSS 0.3%CVE-2026-25536HIGH@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseEPSS 0.3%CVE-2023-52553HIGHRace condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2025-54108HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-8741LOWEMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race conditionEPSS 0.3%CVE-2025-53807HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-49665HIGHWorkspace Broker Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-54114HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-12383CRITICALRace Condition allows Bypass of Trust RestrictionsEPSS 0.3%CVE-2024-26779HIGHwifi: mac80211: fix race condition on enabling fast-xmitEPSS 0.3%CVE-2025-40569MEDIUMA vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All vEPSS 0.3%CVE-2020-27825—A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and EPSS 0.3%CVE-2025-0439MEDIUMRace in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to pEPSS 0.3%CVE-2025-66803MEDIUMRace condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responsEPSS 0.3%CVE-2024-50297HIGHnet: xilinx: axienet: Enqueue Tx packets in dql before dmaengine startsEPSS 0.3%CVE-2026-50139MEDIUMgoshs: Share-link ?token=… redemption races past download limitEPSS 0.3%CVE-2026-85704MEDIUMramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race conditionEPSS 0.3%