Falhas do tipo CWE-367

800 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2026-3428MEDIUMA Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve prEPSS 0.1%CVE-2026-12374MEDIUMImproper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperToolEPSS 0.1%CVE-2025-27076HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in DisplayEPSS 0.1%CVE-2025-21473HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Camera_LinuxEPSS 0.1%CVE-2023-44128MEDIUMLGInstallService - Deletion of arbitrary files with system privilegeEPSS 0.1%CVE-2026-20908MEDIUMTime-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a EPSS 0.1%CVE-2026-54055MEDIUMKitty has an Arbitrary File Write via Symlink Race Condition in File Transmission ProtocolEPSS 0.1%CVE-2025-52532LOWA race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmdEPSS 0.1%CVE-2022-33691MEDIUMA possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious opEPSS 0.1%CVE-2026-28671LOWIn updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local infoEPSS 0.1%CVE-2023-20623MEDIUMIn ion, there is a possible escalation of privilege due to improper locking. This could lead to local escalation of privilege with no additiEPSS 0.1%CVE-2026-77804MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® ClassicEPSS 0.1%CVE-2026-20438MEDIUMIn MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actEPSS 0.1%CVE-2026-106405MEDIUMRace condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via EPSS 0.1%CVE-2025-47332MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverEPSS 0.1%CVE-2025-47344MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverEPSS 0.1%CVE-2025-59610MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverEPSS 0.1%CVE-2025-47407HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in DSP ServiceEPSS 0.1%CVE-2026-25260HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in DSP ServiceEPSS 0.1%CVE-2026-92606MEDIUMTOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputerEPSS —