Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-17724MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) vEPSS 0.2%CVE-2025-12432HIGHRace in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 0.2%CVE-2026-40178MEDIUMajenti.plugin.core has a race conditions in 2FAEPSS 0.2%CVE-2026-55318HIGHIn multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additionEPSS 0.2%CVE-2026-71537MEDIUMPaymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)EPSS 0.2%CVE-2022-3521LOWLinux Kernel kcm kcmsock.c kcm_tx_work race conditionEPSS 0.2%CVE-2024-40849HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of itsEPSS 0.2%CVE-2025-15242LOWPHPEMS Coupon race conditionEPSS 0.2%CVE-2026-45090HIGHDalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)EPSS 0.2%CVE-2026-10006HIGHRace in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftedEPSS 0.2%CVE-2025-49678HIGHNTFS Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-86766HIGHSnipe-IT 8.6.3 Race Condition via Consumable CheckoutEPSS 0.2%CVE-2025-32441MEDIUMRack session gets restored after deletionEPSS 0.2%CVE-2026-79117MEDIUMRace condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeriEPSS 0.2%CVE-2026-26181HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-34368MEDIUMAVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceEPSS 0.2%CVE-2020-27837—A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the EPSS 0.2%CVE-2026-10940HIGHRace in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to poteEPSS 0.2%CVE-2021-20261—A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issueEPSS 0.2%CVE-2026-7208MEDIUMYealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File DeletionEPSS 0.2%