cve.bz

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 6

Filter

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

Ask an AI about CWE-362

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/362.html and https://cve.bz/cve/cwe/362?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.0CVE-2026-77638EPSS 0.3%

    Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.

  2. 5.9CVE-2025-62300EPSS 0.2%

    HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.

  3. 5.9CVE-2026-76393EPSS 0.2%

    In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to refe…

  4. 7.0CVE-2026-62727EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  5. 8.1CVE-2026-19506EPSS 0.5%

    Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state.

  6. 7.5CVE-2026-45742EPSS 0.7%

    Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines t…

  7. 7.4CVE-2026-58088EPSS 0.1%

    The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork(2) ca…

  8. 5.9CVE-2026-50139EPSS 0.3%

    goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent req…

  9. 6.8CVE-2026-74984EPSS 0.3%

    Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  10. 4.2CVE-2026-74973EPSS 0.2%

    Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  11. 6.9CVE-2026-1199EPSS 0.2%

    Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.

  12. 3.1CVE-2026-64782EPSS 0.4%

    A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web …

  13. 3.1CVE-2026-64779EPSS 0.4%

    A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web …

  14. 6.0CVE-2026-64865EPSS 0.3%

    New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because cont…

  15. 1.3CVE-2026-19975EPSS 0.3%

    A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-chec…

  16. 9.8CVE-2026-72064EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when frag_count is greater than 1. In that case the buffers remain DMA mapp…

  17. 7.8CVE-2026-72024EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local->interfaces under RCU. The bulk hardware teardown path removes entries…

  18. 7.8CVE-2026-72009EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behav…

  19. 5.9CVE-2026-13198EPSS 0.1%

    Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a…

  20. 7.3CVE-2026-13197EPSS 0.1%

    Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in ver…

  21. 6.3CVE-2026-73557EPSS 0.2%

    vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, a…

  22. 4.1CVE-2026-0295EPSS 0.1%

    A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS i…

  23. 4.2CVE-2026-7366EPSS 0.2%

    IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handl…

  24. 5.3CVE-2026-18150EPSS 0.3%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.

  25. 5.0CVE-2026-18250EPSS 0.3%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.

  26. 8.1CVE-2026-66802EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

  27. 7.0CVE-2026-62908EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

  28. 8.1CVE-2026-62820EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.

  29. 7.0CVE-2026-62780EPSS 0.2%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  30. 8.1CVE-2026-62778EPSS 0.5%

    Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network.

  31. 7.0CVE-2026-62748EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  32. 7.0CVE-2026-62734EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  33. 7.0CVE-2026-62729EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  34. 7.0CVE-2026-62705EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

  35. 7.0CVE-2026-62693EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

  36. 7.0CVE-2026-62690EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  37. 7.0CVE-2026-61927EPSS 0.2%

    Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

  38. 6.6CVE-2026-61920EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.

  39. 8.1CVE-2026-61352EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  40. 7.8CVE-2026-61349EPSS 0.3%

    Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.

  41. 7.0CVE-2026-59126EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

  42. 7.0CVE-2026-59122EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

  43. 2.5CVE-2026-11812EPSS 0.1%

    The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-f…

  44. 8.4CVE-2026-71968EPSS 0.1%

    OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory …

  45. 7.8CVE-2026-68417EPSS 0.10%

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready…

  46. 7.8CVE-2026-68384EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xe_bo_move() attaches VF CCS read/write batch buffers (BBs) to a BO after it transitions NULL/SYSTEM -> …

  47. 7.8CVE-2026-68382EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm…

  48. 7.8CVE-2026-68338EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It reco…

  49. 8.8CVE-2026-68329EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. I…

  50. 7.8CVE-2026-68323EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: tipc: serialize udp bearer replicast list updates tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with list_add_rcu() / list_del_rcu(), but nothing …