cve.bz

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 2

Filter

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

Ask an AI about CWE-362

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/362.html and https://cve.bz/cve/cwe/362?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.0CVE-2026-87710EPSS 0.1%

    Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

  2. 7.0CVE-2026-85941EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

  3. 7.0CVE-2026-85912EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

  4. 7.0CVE-2026-85904EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  5. 7.0CVE-2026-85825EPSS 0.2%

    Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  6. 7.0CVE-2026-85824EPSS 0.2%

    Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.

  7. 7.0CVE-2026-85357EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.

  8. 7.0CVE-2026-85333EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.

  9. 7.0CVE-2026-85329EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.

  10. 7.0CVE-2026-84014EPSS 0.2%

    Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  11. 7.0CVE-2026-83899EPSS 0.2%

    Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.

  12. 7.0CVE-2026-83879EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

  13. 7.0CVE-2026-83868EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

  14. 7.0CVE-2026-83841EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.

  15. 7.0CVE-2026-83775EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

  16. 7.0CVE-2026-83738EPSS 0.3%

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  17. 7.0CVE-2026-83722EPSS 0.2%

    Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

  18. 7.0CVE-2026-83666EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

  19. 7.0CVE-2026-81971EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.

  20. 7.0CVE-2026-71347EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.

  21. 8.8CVE-2026-70250EPSS 0.5%

    Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.

  22. 4.7CVE-2026-70195EPSS 0.3%

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

  23. 7.5CVE-2026-70183EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

  24. 7.0CVE-2026-70169EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

  25. 5.6CVE-2026-70097EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.

  26. 7.0CVE-2026-69935EPSS 0.2%

    Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

  27. 7.0CVE-2026-69931EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.

  28. 7.0CVE-2026-69856EPSS 0.2%

    Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

  29. 8.1CVE-2026-69830EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  30. 7.0CVE-2026-69766EPSS 0.2%

    Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

  31. 7.0CVE-2026-69763EPSS 0.2%

    Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

  32. 7.0CVE-2026-69736EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-103568EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.

  34. 7.0CVE-2026-102211EPSS 0.2%

    Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.

  35. 7.0CVE-2026-102207EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

  36. 7.7CVE-2026-82416EPSS 0.3%

    FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at…

  37. 8.8CVE-2026-79610EPSS 0.1%

    XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed…

  38. 8.3CVE-2026-109954EPSS 0.2%

    Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or …

  39. 6.0CVE-2026-109945EPSS 0.2%

    FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs thr…

  40. 4.2CVE-2026-109779EPSS 0.1%

    Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

  41. 4.2CVE-2026-109776EPSS 0.1%

    Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  42. 4.2CVE-2026-109765EPSS 0.2%

    Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  43. 8.3CVE-2026-109757EPSS 0.3%

    Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  44. 4.2CVE-2026-109719EPSS 0.2%

    Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  45. 2.3CVE-2026-109407EPSS 0.2%

    A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to …

  46. 4.8CVE-2026-19936EPSS 0.1%

    The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronizatio…

  47. 3.7CVE-2026-42689EPSS 0.2%

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.

  48. 2.0CVE-2026-109279EPSS 0.09%

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer o…

  49. 4.0CVE-2026-93694EPSS 0.07%

    In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService…

  50. 1.3CVE-2026-108830EPSS 0.2%

    A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the at…