Falhas do tipo CWE-367

799 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2026-57818HIGHApache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProviderEPSS 0.5%CVE-2026-58299HIGHMicrosoft Edge for Android Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-29833HIGHMicrosoft Virtual Machine Bus (VMBus) Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-24260HIGHNVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A succEPSS 0.5%CVE-2025-49558MEDIUMAdobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.5%CVE-2024-2440MEDIUMRace Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissionsEPSS 0.5%CVE-2026-112576MEDIUMA memory integrity issue was addressed with improved handling of copy-on-write pages. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iEPSS 0.4%CVE-2024-49046HIGHWindows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2022-3093HIGHThis vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploitEPSS 0.4%CVE-2024-39826MEDIUMZoom Workplace Apps and SDKs - Path traversalEPSS 0.4%CVE-2025-48001MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2025-55680HIGHWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-7531MEDIUMCalling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy BridgeEPSS 0.4%CVE-2025-69233MEDIUMApache CloudStack: Domain/account resources limits not honoredEPSS 0.4%CVE-2026-54754CRITICALKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)EPSS 0.4%CVE-2023-32156CRITICALTesla Model 3 Gateway Firmware Signature Validation Bypass VulnerabilityEPSS 0.4%CVE-2025-55236HIGHGraphics Kernel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-21362MEDIUMWindows Kernel Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-53517HIGHBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family ForkingEPSS 0.4%CVE-2026-26017HIGHCoreDNS ACL BypassEPSS 0.4%