cve.bz

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 19

Filter

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

Ask an AI about CWE-362

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/362.html and https://cve.bz/cve/cwe/362?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.9CVE-2025-52517EPSS 0.2%

    An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver results in a double free, leading to a denial of service.

  2. 5.1CVE-2025-52515EPSS 0.10%

    An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the issimian device driver results in an out-of-bounds access, leading to a denial of s…

  3. 2.9CVE-2025-15244EPSS 0.4%

    A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is…

  4. 1.3CVE-2025-15242EPSS 0.2%

    A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function of the component Coupon Handler. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an…

  5. 2.9CVE-2025-15116EPSS 0.4%

    A security flaw has been discovered in OpenCart up to 4.1.0.3. Affected by this issue is some unknown functionality of the component Single-Use Coupon Handler. Performing a manipulation results in race condition. The attack may be initiate…

  6. 4.7CVE-2025-68749EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix race condition when unbinding BOs Fix 'Memory manager not clean during takedown' warning that occurs when ivpu_gem_bo_free() removes the BO from the BOs …

  7. 3.1CVE-2025-43531EPSS 0.5%

    A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously craft…

  8. 6.5CVE-2025-68146EPSS 0.2%

    filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulne…

  9. 7.0CVE-2025-33235EPSS 0.1%

    NVIDIA Resiliency Extension for Linux contains a vulnerability in the checkpointing core, where an attacker may cause a race condition. A successful exploit of this vulnerability might lead to information disclosure, data tampering, denial…

  10. 4.7CVE-2025-68214EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a W…

  11. 6.5CVE-2025-13231EPSS 0.2%

    The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_…

  12. 7.5CVE-2025-66446EPSS 0.3%

    MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escala…

  13. 10.0CVE-2025-66419EPSS 0.3%

    MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in vers…

  14. 7.4CVE-2025-36934EPSS 0.10%

    In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…

  15. 7.0CVE-2025-36916EPSS 0.06%

    In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e…

  16. 8.4CVE-2025-67505EPSS 0.2%

    Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response hea…

  17. 7.8CVE-2025-64661EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

  18. 7.5CVE-2025-64658EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

  19. 7.0CVE-2025-62573EPSS 0.2%

    Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

  20. 7.0CVE-2025-62469EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

  21. 7.0CVE-2025-48625EPSS 0.07%

    In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privilege…

  22. 7.0CVE-2025-48564EPSS 0.10%

    In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  23. 4.7CVE-2025-66328EPSS 0.07%

    Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability.

  24. 4.7CVE-2025-66327EPSS 0.07%

    Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  25. 4.7CVE-2025-66326EPSS 0.07%

    Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.

  26. 4.7CVE-2025-66322EPSS 0.07%

    Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  27. 4.7CVE-2025-66321EPSS 0.07%

    Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  28. 4.7CVE-2025-66320EPSS 0.07%

    Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  29. 7.5CVE-2025-13721EPSS 0.3%

    Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

  30. 4.7CVE-2025-20765EPSS 0.08%

    In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: …

  31. 5.5CVE-2025-64313EPSS 0.08%

    Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.

  32. 5.5CVE-2025-58316EPSS 0.08%

    DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability.

  33. 5.5CVE-2025-58303EPSS 0.08%

    UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  34. 7.1CVE-2025-12472EPSS 0.3%

    An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were foun…

  35. 9.4CVE-2025-12383EPSS 0.3%

    In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeE…

  36. 7.5CVE-2024-7017EPSS 0.2%

    Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  37. 1.8CVE-2025-64345EPSS 0.1%

    Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe…

  38. 7.0CVE-2025-62219EPSS 0.3%

    Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.

  39. 7.0CVE-2025-62218EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.

  40. 7.0CVE-2025-62217EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  41. 7.0CVE-2025-62215KEVExploitEPSS 4.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

  42. 6.3CVE-2025-60723EPSS 0.9%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network.

  43. 7.0CVE-2025-59508EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

  44. 7.0CVE-2025-59507EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

  45. 7.0CVE-2025-59506EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally.

  46. 3.7CVE-2025-64773EPSS 0.2%

    In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit

  47. 7.5CVE-2025-13012EPSS 0.2%

    Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  48. 4.2CVE-2025-12434EPSS 0.2%

    Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  49. 8.8CVE-2025-12432EPSS 0.2%

    Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  50. 7.5CVE-2025-64683EPSS 0.2%

    In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API