CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, page 12

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

What the weakness is: CWE-367 at MITRE

1. 3.7CVE-2025-24432EPSS 0.4%2025-02-11

   Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could e…

2. 3.7CVE-2025-24430EPSS 0.4%2025-02-11

   Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could e…

3. 7.0CVE-2025-24036EPSS 0.4%2025-02-11

   Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

4. 7.8CVE-2024-48394EPSS 0.1%2025-02-05

   A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to exploit this flaw and gain SYSTEM-level access on the device. The vulnerability af…

5. 7.0CVE-2024-45560EPSS 0.07%2025-02-03

   Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

6. 7.0CVE-2024-38418EPSS 0.07%2025-02-03

   Memory corruption while parsing the memory map info in IOCTL calls.

7. 2.1CVE-2024-37181EPSS 0.1%2025-01-16

   Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable information disclosure via adjacent access.

8. 7.0CVE-2025-22394EPSS 0.1%2025-01-15

   Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code executio…

9. 7.8CVE-2024-42444EPSS 0.1%2025-01-14

   APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to execution of arbitrary code on the target device.

10. 8.1CVE-2024-41787EPSS 1.1%2025-01-10

    IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerabil…

11. 9.8CVE-2024-56337EPSS 9.0%2024-12-20

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were E…

12. 9.8CVE-2024-50379EPSS 32%2024-12-17

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue …

13. 7.3CVE-2024-10972EPSS 0.2%2024-12-16

    Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the use…

14. 7.0CVE-2024-53289EPSS 0.1%2024-12-11

    Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

15. 7.0CVE-2024-27134EPSS 0.1%2024-11-25

    Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when t…

16. 8.1CVE-2024-41779EPSS 0.8%2024-11-22

    IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulne…

17. 8.5CVE-2024-22185EPSS 0.1%2024-11-13

    Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privilege via local access.

18. 7.8CVE-2024-49046EPSS 0.4%2024-11-12

    Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

19. 7.5CVE-2024-43452EPSS 30%2024-11-12

    Windows Registry Elevation of Privilege Vulnerability

20. 6.5CVE-2024-51563EPSS 0.3%2024-11-12

    The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.

21. 8.1CVE-2024-48322EPSS 0.9%2024-11-11

    UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.

22. 7.0CVE-2024-50234EPSS 0.2%2024-11-09

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn…

23. 4.7CVE-2024-50220EPSS 0.2%2024-11-09

    In the Linux kernel, the following vulnerability has been resolved: fork: do not invoke uffd on fork if error occurs Patch series "fork: do not expose incomplete mm on fork". During fork we may place the virtual memory address space int…

24. 7.0CVE-2024-50592EPSS 0.2%2024-11-08

    An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using …

25. 7.0CVE-2024-38407EPSS 0.07%2024-11-04

    Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.

26. 7.0CVE-2024-38406EPSS 0.07%2024-11-04

    Memory corruption while handling IOCTL calls in JPEG Encoder driver.

27. 4.8CVE-2024-49768EPSS 0.5%2024-10-29

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is d…

28. 4.7CVE-2024-49998EPSS 0.2%2024-10-21

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens…

29. 8.2CVE-2024-47494EPSS 0.4%2024-10-11

    A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who is already causing impact to established sessions which generates counter changes picked up by the …

30. 3.1CVE-2024-45120EPSS 0.4%2024-10-10

    Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to a security feature bypass. An attacker could exploit this vuln…

31. 2.9CVE-2024-47813EPSS 0.2%2024-10-09

    Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to double-unregistration bugs due to a race condition, leading to panics and potent…

32. 7.0CVE-2024-43511EPSS 0.4%2024-10-08

    Windows Kernel Elevation of Privilege Vulnerability

33. 7.5CVE-2024-5803EPSS 0.1%2024-10-03

    The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time-of-use (TOCTOU) when self protection is disabled.

34. 3.4CVE-2024-0133EPSS 0.2%2024-09-26

    NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is us…

35. 8.3CVE-2024-0132ExploitEPSS 41%2024-09-26

    NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not…

36. 6.0CVE-2024-6787EPSS 0.3%2024-09-21

    This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could al…

37. 8.9CVE-2024-27114EPSS 0.5%2024-09-11

    A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few millisecon…

38. 7.0CVE-2024-43882EPSS 0.2%2024-08-21

    In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at tha…

39. 7.0CVE-2024-39425EPSS 0.2%2024-08-14

    Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issu…

40. 7.0CVE-2024-39420EPSS 3.5%2024-08-14

    Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could…

41. 7.8CVE-2024-38186EPSS 0.8%2024-08-13

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

42. 7.8CVE-2024-38153EPSS 0.5%2024-08-13

    Windows Kernel Elevation of Privilege Vulnerability

43. 6.4CVE-2023-20578EPSS 0.1%2024-08-13

    A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.

44. 7.5CVE-2024-7348EPSS 1.6%2024-08-08

    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation …

45. 6.5CVE-2024-7531EPSS 0.4%2024-08-06

    Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is …

46. 4.7CVE-2024-42107EPSS 0.2%2024-07-30

    In the Linux kernel, the following vulnerability has been resolved: ice: Don't process extts if PTP is disabled The ice_ptp_extts_event() function can race with ice_ptp_release() and result in a NULL pointer dereference which leads to a …

47. 3.7CVE-2024-30471EPSS 0.7%2024-07-17

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email a…

48. 6.8CVE-2024-39826EPSS 0.4%2024-07-15

    Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.

49. 4.4CVE-2024-39821EPSS 0.1%2024-07-15

    Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access.

50. 6.3CVE-2024-27238EPSS 0.1%2024-07-15

    Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access.