cve.bz

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, page 11

Filter

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

What the weakness is: CWE-367 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High
  • CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-367, as MITRE names them. Credits.

Ask an AI about CWE-367

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/367.html and https://cve.bz/cve/cwe/367?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2025-49730ExploitEPSS 0.7%

    Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.

  2. 6.8CVE-2025-48818EPSS 0.5%

    Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  3. 6.8CVE-2025-48001EPSS 0.4%

    Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  4. 4.7CVE-2025-38217EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (ftsteutates) Fix TOCTOU race in fts_read() In the fts_read() function, when handling hwmon_pwm_auto_channels_temp, the code accesses the shared variable data->fa…

  5. 4.7CVE-2025-38112EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net: Fix TOCTOU issue in sk_is_readable() sk->sk_prot->sock_is_readable is a valid function pointer when sk resides in a sockmap. After the last sk_psock_put() (which us…

  6. 3.2CVE-2025-46415EPSS 0.1%

    A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.…

  7. 2.5CVE-2025-6217EPSS 0.1%

    PEAK-System Driver PCANFD_ADD_FILTERS Time-Of-Check Time-Of-Use Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of PEAK-System Driver. An attacker …

  8. 8.4CVE-2025-3464EPSS 0.6%

    A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass. Refer to the 'Security Update for Armoury Crate App' section on the ASU…

  9. 5.9CVE-2024-9512EPSS 0.3%

    An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary n…

  10. 7.8CVE-2025-21485EPSS 0.08%

    Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

  11. 6.6CVE-2024-53018EPSS 0.08%

    Memory corruption may occur while processing the OIS packet parser.

  12. 6.6CVE-2024-53016EPSS 0.08%

    Memory corruption while processing I2C settings in Camera driver.

  13. 5.7CVE-2025-46805EPSS 0.2%

    Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.

  14. 10.0CVE-2025-34027ExploitEPSS 46%

    The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for …

  15. 7.6CVE-2025-47290EPSS 0.5%

    containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host fi…

  16. 7.0CVE-2025-30663EPSS 0.1%

    Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.

  17. 8.7CVE-2025-20082EPSS 0.1%

    Time-of-check time-of-use race condition in the UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to enable escalation of privilege via local access.

  18. 7.5CVE-2025-29969EPSS 1.2%

    Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.

  19. 7.7CVE-2025-29833EPSS 0.5%

    Time-of-check time-of-use (toctou) race condition in Windows Virtual Machine Bus allows an unauthorized attacker to execute code locally.

  20. 7.0CVE-2024-42446EPSS 0.1%

    APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.

  21. 7.8CVE-2024-13961EPSS 0.2%

    Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM …

  22. 7.8CVE-2024-13960EPSS 0.2%

    Link Following Local Privilege Escalation Vulnerability in TuneUp Service in AVG TuneUp Version 23.4 (build 15592) on Windows 10 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating…

  23. 7.8CVE-2024-13944EPSS 0.2%

    Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the contex…

  24. 4.2CVE-2025-46336EPSS 0.4%

    Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), …

  25. 6.3CVE-2025-30101EPSS 0.2%

    Dell PowerScale OneFS, versions 9.8.0.0 through 9.10.1.0, contain a time-of-check time-of-use (TOCTOU) race condition vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to den…

  26. 4.2CVE-2025-32441EPSS 0.3%

    Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that sess…

  27. 7.0CVE-2024-45565EPSS 0.08%

    Memory corruption when blob structure is modified by user-space after kernel verification.

  28. 5.0CVE-2024-6029EPSS 0.2%

    Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris modem in affected Tesla Model S vehicles. Authentication is not required to expl…

  29. 7.5CVE-2025-3599EPSS 0.3%

    Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an app…

  30. 7.0CVE-2025-46328EPSS 0.2%

    snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS th…

  31. 7.0CVE-2025-46327EPSS 0.1%

    gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads l…

  32. 7.0CVE-2025-46326EPSS 0.2%

    snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, th…

  33. 4.7CVE-2025-22060EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications. Both the…

  34. 7.5CVE-2025-32784EPSS 0.3%

    conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shar…

  35. 8.1CVE-2025-27812EPSS 0.1%

    MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation.

  36. 7.0CVE-2025-21191EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.

  37. 4.7CVE-2025-21431EPSS 0.08%

    Information disclosure may be there when a guest VM is connected.

  38. 7.8CVE-2024-43067EPSS 0.10%

    Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

  39. 4.7CVE-2025-21998EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has be…

  40. 4.7CVE-2025-21958EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_c…

  41. 7.0CVE-2024-54084EPSS 0.1%

    APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.

  42. 8.6CVE-2024-53694EPSS 0.1%

    A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise una…

  43. 8.2CVE-2025-22224KEVEPSS 1.6%

    VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute cod…

  44. 7.0CVE-2024-53032EPSS 0.09%

    Memory corruption may occur in keyboard virtual device due to guest VM interaction.

  45. 7.0CVE-2024-53028EPSS 0.09%

    Memory corruption may occur while processing message from frontend during allocation.

  46. 3.3CVE-2025-0759EPSS 0.1%

    IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization.

  47. 4.7CVE-2025-21746EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through po…

  48. 6.3CVE-2025-26620EPSS 0.4%

    Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent …

  49. 5.4CVE-2024-41917EPSS 0.1%

    Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  50. 8.1CVE-2025-23359EPSS 3.7%

    NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vu…