CAPEC-26
Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-26: Leveraging Race Conditions: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/26.html and https://cve.bz/cve/capec/26?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
The adversary explores to gauge what level of access they have.
Experiment
They probe what they found.
The adversary gains access to a resource on the target host. The adversary modifies the targeted resource. The resource's value is used to determine the next normal execution action.
Exploit
They carry out the attack.
The resource is modified/checked concurrently by multiple processes. By using one of the processes, the adversary is able to modify the value just before it is consumed by a different process. A race condition occurs and is exploited by the adversary to abuse the target host.
Prerequisites
A resource is accessed/modified concurrently by multiple processes such that a race condition exists.
The adversary has the ability to modify the resource.
Skills required
- Medium skill
Being able to "run the race" requires basic knowledge of concurrent processing including synchonization techniques.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Confidentiality, Access Control, Authorization | |
| Modify Data | Integrity |
Mitigations
Use safe libraries to access resources such as files.
Be aware that improper use of access function calls such as chown(), tempfile(), chmod(), etc. can cause a race condition.
Use synchronization to control the flow of execution.
Use static analysis tools to find race conditions.
Pay attention to concurrency problems related to the access of resources.
Weaknesses it exploits
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
- CWE-363 Race Condition Enabling Link Following
- CWE-366 Race Condition within a Thread
- CWE-368 Context Switching Race Condition
- CWE-370 Missing Check for Certificate Revocation after Initial Check
- CWE-662 Improper Synchronization
- CWE-665 Improper Initialization
- CWE-667 Improper Locking
- CWE-689 Permission Race Condition During Resource Copy
- CWE-1223 Race Condition for Write-Once Attributes
- CWE-1254 Incorrect Comparison Logic Granularity
- CWE-1298 Hardware Logic Contains Race Conditions
Recent CVEs with these weaknesses
- 6.8CVE-2026-123804
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login meth…
- 4.8CVE-2026-124622
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgradi…
- 3.7CVE-2026-123128
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items …
- 7.4CVE-2026-17337
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connecti…
- 5.9CVE-2026-92694
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map withou…
- 5.8CVE-2026-112938
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the clai…
- 2.5CVE-2026-112907
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wa…
- 7.7CVE-2026-111770
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- More specific patterns
- CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
Examples
The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VP…
The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files with insecure permissions, which allows local users to exploit a race condition to replace a world-writable file in /tmp/NetClient and cause another user to execute arbitrary code when attempting to execute this client, as demonstrated by replacing /tmp/NetClient/client. See also: CVE-2007-1057
The following code illustrates a file that is accessed multiple times by name in a publicly accessible direct…
The following code illustrates a file that is accessed multiple times by name in a publicly accessible directory. A race condition exists between the accesses where an attacker can replace the file referenced by the name (see [REF-107]).
include<sys/types.h>
include<fcntl.h>
include<unistd.h>
define FILE "/tmp/myfile"
define UID 100
void test(char *str)
{
int fd;
fd = creat(FILE, 0644);
if(fd == -1)
return;
chown(FILE, UID, -1); /* BAD */
close(fd);
}
int main(int argc, char **argv)
{
char *userstr;
if(argc>1) {
userstr = argv[1];
test(userstr);
}
return 0;
}MITRE's words, unchanged: CAPEC-26 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.