CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, page 2
Filter
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
What the weakness is: CWE-367 at MITRE
Related attack patterns (CAPEC): 2
- CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High
- CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-367, as MITRE names them. Credits.
Ask an AI about CWE-367
Show the prompt
Explain CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/367.html and https://cve.bz/cve/cwe/367?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.0CVE-2026-62840EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-97774EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-96939EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
- 4.7CVE-2026-96853EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- 8.1CVE-2026-88173EPSS 0.5%
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
- 7.0CVE-2026-85943EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-85920EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-85879EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-84018EPSS 0.2%
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
- 4.7CVE-2026-84009EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.
- 7.0CVE-2026-83871EPSS 0.2%
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-83839EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-83834EPSS 0.3%
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-83750EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- 4.7CVE-2026-83697EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- 7.0CVE-2026-83510EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-83505EPSS 0.3%
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
- 4.7CVE-2026-83504EPSS 0.3%
Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
- 5.5CVE-2026-70288EPSS 0.4%
Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-70122EPSS 0.3%
Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
- 4.4CVE-2026-70075EPSS 0.3%
Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
- 7.0CVE-2026-108396EPSS 0.2%
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
- 4.2CVE-2026-102832EPSS 0.1%
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracke…
- 6.7CVE-2026-102672EPSS 0.09%
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerab…
- 7.2CVE-2026-108361EPSS 0.08%
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful …
- 8.3CVE-2026-108698EPSS 0.2%
hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry …
- 2.3CVE-2026-108741EPSS 0.2%
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers …
- 8.1CVE-2026-73179EPSS 0.4%
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurren…
- 3.7CVE-2026-67693EPSS 0.2%
GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of…
- 6.3CVE-2026-107276EPSS 0.2%
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause…
- 7.7CVE-2026-103435EPSS 0.3%
Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap a…
- 8.1CVE-2026-89430EPSS 0.3%
Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blo…
- 7.3CVE-2026-106451EPSS 0.1%
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then…
- 4.3CVE-2026-101029EPSS 0.2%
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged…
- 4.2CVE-2026-106413EPSS 0.1%
Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- 8.3CVE-2026-106412EPSS 0.2%
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a cr…
- 6.0CVE-2026-106405EPSS 0.07%
Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)
- 4.7CVE-2026-106300EPSS 0.2%
Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.8CVE-2026-106207EPSS 0.3%
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 5.8CVE-2026-93315EPSS 0.10%
When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build.
- 5.8CVE-2026-105743EPSS 0.2%
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hos…
- 4.0CVE-2026-105647EPSS 0.2%
Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server'…
- 6.6CVE-2026-77804EPSS 0.07%
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certi…
- 6.9CVE-2026-105163EPSS 0.3%
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use…
- 6.3CVE-2026-105130EPSS 0.3%
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily registration limit. Attackers can send many concurrent registrat…
- 5.4CVE-2026-104474EPSS 0.08%
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace th…
- 7.8CVE-2026-47497EPSS 0.1%
NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerabi…
- 5.3CVE-2026-79417EPSS 0.2%
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRP_MJ_CREATE and send a crafted IOCTL …
- 5.3CVE-2026-95360EPSS 0.2%
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.0CVE-2026-95344EPSS 0.2%
Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Medium)