Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-15119HIGHRace in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentiaEPSS 0.2%CVE-2020-19824HIGHAn issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c parameter.EPSS 0.2%CVE-2026-90506LOWvvbbnn00 WARP-Clash-API Save Account Job race conditionEPSS 0.2%CVE-2026-90505LOWvvbbnn00 WARP-Clash-API doUpdateLicenseKey race conditionEPSS 0.2%CVE-2025-46613HIGHOpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frEPSS 0.2%CVE-2026-47741MEDIUMShopper: Race condition on Discount.usage_limit allows silent over-redemptionEPSS 0.2%CVE-2026-61349HIGHWindows Work Folder Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2019-3837MEDIUMIt was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threEPSS 0.2%CVE-2025-62219HIGHMicrosoft Wireless Provisioning System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-59324HIGHfluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionEPSS 0.2%CVE-2025-62218HIGHMicrosoft Wireless Provisioning System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-92042HIGHRace condition in the DOM: Content Processes componentEPSS 0.2%CVE-2026-43930LOWParse Server: MFA SMS one-time password accepted twice under concurrent loginEPSS 0.2%CVE-2022-27481—A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALAEPSS 0.2%CVE-2022-42791HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrarEPSS 0.2%CVE-2022-1195—A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilegEPSS 0.2%CVE-2026-21221HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-13012HIGHRace condition in the Graphics componentEPSS 0.2%CVE-2026-78979MEDIUMRace condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypaEPSS 0.2%CVE-2026-17724MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) vEPSS 0.2%