Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-47620MEDIUMNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initializationEPSS 0.3%CVE-2026-14015MEDIUMRace in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML pagEPSS 0.3%CVE-2026-14082MEDIUMRace in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (ChromiEPSS 0.3%CVE-2022-45869MEDIUMA race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crEPSS 0.3%CVE-2025-12472HIGHRemote Code Execution in Looker due to Improperly Validated Directory DeletionEPSS 0.3%CVE-2026-55784HIGHfree5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIEPSS 0.3%CVE-2024-20007HIGHIn mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no aEPSS 0.3%CVE-2025-43304HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. AEPSS 0.3%CVE-2026-73557MEDIUMvLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt partsEPSS 0.3%CVE-2025-59195HIGHWindows Graphics Component Denial of Service VulnerabilityEPSS 0.3%CVE-2026-7724LOWPrefectHQ prefect Webhook/Notification validate_restricted_url toctouEPSS 0.3%CVE-2025-64661HIGHWindows Shell Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-62217HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-54497MEDIUMview_component: Reused Component Instances Retain Stale Render ContextEPSS 0.2%CVE-2025-62469HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2022-41848MEDIUMdrivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proxEPSS 0.2%CVE-2025-59216HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-59220HIGHWindows Bluetooth Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-33009HIGHEVerest: MQTT Switch-Phases Command Data Race Causing Charger State CorruptioEPSS 0.2%CVE-2026-78901HIGHRace condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.2%