cve.bz

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 15

Filter

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

Ask an AI about CWE-362

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/362.html and https://cve.bz/cve/cwe/362?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.0CVE-2026-27918EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

  2. 7.8CVE-2026-27911EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

  3. 7.8CVE-2026-26181EPSS 0.2%

    Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

  4. 7.0CVE-2026-26174EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

  5. 7.0CVE-2026-26173EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  6. 7.8CVE-2026-26172EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  7. 7.8CVE-2026-26168EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  8. 7.8CVE-2026-26167EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  9. 7.0CVE-2026-25184EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-20930EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  11. 7.8CVE-2026-31419EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clone…

  12. 4.7CVE-2026-34862EPSS 0.06%

    Race condition vulnerability in the power consumption statistics module. Impact: Successful exploitation of this vulnerability may affect availability.

  13. 4.7CVE-2026-34861EPSS 0.06%

    Race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability.

  14. 4.1CVE-2026-34858EPSS 0.07%

    UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

  15. 5.5CVE-2026-34857EPSS 0.07%

    UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

  16. 4.7CVE-2026-34849EPSS 0.07%

    UAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability.

  17. 7.5CVE-2026-34856EPSS 0.1%

    UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

  18. 7.5CVE-2026-34851EPSS 0.1%

    Race condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availability.

  19. 5.9CVE-2026-34850EPSS 0.2%

    Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability.

  20. 6.9CVE-2026-40178EPSS 0.2%

    ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This …

  21. 6.0CVE-2026-5774EPSS 0.2%

    Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

  22. 9.8CVE-2026-5902EPSS 0.2%

    Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. (Chromium security severity: Low)

  23. 6.8CVE-2026-5893EPSS 0.1%

    Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

  24. 5.3CVE-2026-5890EPSS 0.2%

    Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

  25. 4.9CVE-2026-39880EPSS 0.2%

    Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register…

  26. 8.7CVE-2026-35554EPSS 0.4%

    A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing…

  27. 7.0CVE-2025-54601EPSS 0.08%

    An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Improper synchronization on a global variable leads to a double free…

  28. 7.0CVE-2025-54602EPSS 0.09%

    An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000. Improper synchronization on a global variable leads to a use-after-f…

  29. 4.7CVE-2026-23469EPSS 0.09%

    In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend callback doesn't know whether the IRQ handler is in progress on a different CPU …

  30. 7.8CVE-2026-23466EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Open-code GGTT MMIO access protection GGTT MMIO access is currently protected by hotplug (drm_dev_enter), which works correctly when the driver loads successfull…

  31. 4.7CVE-2026-23463EPSS 0.10%

    In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between fq_table[fq->idx] state and freeing/alloca…

  32. 8.8CVE-2026-23461EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user After commit ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del"), l2cap_conn_del() uses c…

  33. 4.7CVE-2026-23452EPSS 0.10%

    In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has b…

  34. 9.8CVE-2026-23450EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP…

  35. 4.7CVE-2026-23441EPSS 0.09%

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso …

  36. 4.7CVE-2026-23440EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the device reports an ESN (Extended Sequence Number) wrap event to the driver. The driv…

  37. 5.5CVE-2026-23434EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: serialize lock/unlock against other NAND operations nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device…

  38. 7.5CVE-2024-40849EPSS 0.2%

    A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox.

  39. 7.7CVE-2026-33544EPSS 0.4%

    Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct …

  40. 7.4CVE-2026-35099EPSS 0.1%

    Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15.

  41. 7.8CVE-2026-23411EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the fi…

  42. 7.8CVE-2026-23410EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-after-free situation: because the rawdata inodes are not refcounted, an attacker …

  43. 8.2CVE-2026-34363EPSS 0.4%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0-alpha.9, when multiple clients subscribe to the same class via LiveQuery, the event handlers process…

  44. 7.1CVE-2026-33028EPSS 0.6%

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the complete absence of synchronization mechanisms (Mutex) and non-atomic file writes, co…

  45. 7.1CVE-2026-33872EPSS 0.4%

    elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Leakage or Information Disclosure due to a race condition in the worker protocol. The lack of request…

  46. 5.3CVE-2026-34368EPSS 0.2%

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sende…

  47. 6.5CVE-2026-33009EPSS 0.3%

    EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memory corruption). This is triggered by an MQTT `everest_external/nodered/{connector}/cmd/switch_three_phases_while_chargi…

  48. 4.2CVE-2026-27814EPSS 0.1%

    EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with…

  49. 7.0CVE-2026-26074EPSS 0.1%

    EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std::queue>` corruption. The trigger is CSMS GetLog/UpdateFirmware request (network) with an EVSE fault event (physical). …

  50. 4.2CVE-2026-26072EPSS 0.1%

    EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optional>` concurrent access (container/optional corruption possible). The trigger is EV SoC update with powermeter periodic u…