Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-32887HIGHEffect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPCEPSS 0.3%CVE-2025-53807HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-54108HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-54114HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-113282HIGHRace condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processEPSS 0.3%CVE-2022-24951—A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enEPSS 0.3%CVE-2026-7432HIGHA race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMEPSS 0.3%CVE-2025-32441MEDIUMRack session gets restored after deletionEPSS 0.3%CVE-2023-52553HIGHRace condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2025-66803MEDIUMRace condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responsEPSS 0.3%CVE-2026-8741LOWEMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race conditionEPSS 0.3%CVE-2024-26779HIGHwifi: mac80211: fix race condition on enabling fast-xmitEPSS 0.3%CVE-2025-49690HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-113016HIGHRace condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systeEPSS 0.3%CVE-2026-53358HIGHBluetooth: L2CAP: use chan timer to close channels in cleanup_listen()EPSS 0.3%CVE-2026-113150HIGHRace condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafEPSS 0.3%CVE-2025-8880HIGHRace in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML EPSS 0.3%CVE-2020-27825—A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and EPSS 0.3%CVE-2026-23230HIGHsmb: client: split cached_fid bitfields to avoid shared-byte RMW racesEPSS 0.3%CVE-2022-42791HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrarEPSS 0.3%