cve.bz

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, page 9

Filter

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

What the weakness is: CWE-367 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High
  • CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-367, as MITRE names them. Credits.

Ask an AI about CWE-367

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/367.html and https://cve.bz/cve/cwe/367?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.4CVE-2026-31997EPSS 0.09%

    OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute …

  2. 5.8CVE-2026-27670EPSS 0.08%

    OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory. Attackers can exploit a time-of-check-time-of-use race betw…

  3. 2.3CVE-2026-32943EPSS 0.2%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user r…

  4. 6.9CVE-2026-27545EPSS 0.10%

    OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locations by rebinding writable parent symlinks in the current worki…

  5. 5.6CVE-2025-22850EPSS 0.08%

    Time-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an information disclosure. System software adversary with a privileged user combined with a high complexity attack may enabl…

  6. 7.1CVE-2025-20028EPSS 0.08%

    Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may ena…

  7. 5.9CVE-2026-31824EPSS 0.2%

    Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit (the…

  8. 7.3CVE-2026-2364EPSS 0.09%

    If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCTOU vulnerability in the CODESYS installer.

  9. 6.3CVE-2026-28689EPSS 0.1%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time a…

  10. 6.3CVE-2026-26017EPSS 0.4%

    CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated be…

  11. 7.0CVE-2026-27750EPSS 0.1%

    Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them dur…

  12. 4.4CVE-2026-20445EPSS 0.1%

    In MDDP, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10…

  13. 6.4CVE-2026-20438EPSS 0.07%

    In MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patc…

  14. 2.0CVE-2026-21725EPSS 0.2%

    A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin…

  15. 6.9CVE-2026-27128EPSS 0.2%

    Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly s…

  16. 7.0CVE-2026-27127EPSS 0.5%

    Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-o…

  17. 5.8CVE-2026-27189EPSS 0.1%

    OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concur…

  18. 6.9CVE-2026-25738EPSS 0.3%

    Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs i…

  19. 4.7CVE-2026-23212EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE()…

  20. 5.3CVE-2025-71225EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: md: suspend array while updating raid_disks via sysfs In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->ra…

  21. 3.1CVE-2026-20796EPSS 0.2%

    Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams …

  22. 8.5CVE-2026-26224EPSS 0.1%

    Intego Log Reporter, a macOS diagnostic utility bundled with Intego security products that collects system and application logs for support analysis, contains a local privilege escalation vulnerability. A root-executed diagnostic script cr…

  23. 9.0CVE-2026-20677EPSS 0.3%

    A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A shortcut …

  24. 7.1CVE-2023-31324EPSS 0.1%

    A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Trusted Agent (XGMI TA) commands as they are processed potentially resulting in los…

  25. 7.1CVE-2023-20548EPSS 0.1%

    A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, confidentiality, or availability.

  26. 4.6CVE-2024-36311EPSS 0.1%

    A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform an out of bounds read or write, potentially resulting in loss of confidentiality,…

  27. 9.3CVE-2026-25728EPSS 0.3%

    ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application mov…

  28. 8.0CVE-2026-21523EPSS 0.8%

    Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

  29. 7.0CVE-2026-21240EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

  30. 9.0CVE-2026-25641EPSS 0.5%

    SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key us…

  31. 8.3CVE-2025-13818EPSS 0.1%

    Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent

  32. 7.1CVE-2026-25536EPSS 0.3%

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multipl…

  33. 9.4CVE-2026-25052EPSS 0.3%

    n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the…

  34. 7.3CVE-2026-0924EPSS 0.2%

    BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2.

  35. 7.8CVE-2026-24071EPSS 0.2%

    It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection …

  36. 6.8CVE-2025-67124EPSS 0.3%

    A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can creat…

  37. 7.0CVE-2026-23988EPSS 0.2%

    Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the creation, validation, and execution of the Fido PowerShell script. Since Rufus run…

  38. 4.8CVE-2026-22281EPSS 0.2%

    Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condit…

  39. 3.1CVE-2026-1035EPSS 0.3%

    A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and updat…

  40. 5.9CVE-2026-23950EPSS 0.3%

    node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-…

  41. 6.8CVE-2026-21912EPSS 0.1%

    A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the method to collect FPC Ethernet firmware statistics of Juniper Networks Junos OS on MX10k Series allows a local, low-privileged attacker executing the 'show system fir…

  42. 6.3CVE-2026-22820EPSS 0.2%

    Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.

  43. 4.7CVE-2025-71111EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shar…

  44. 7.0CVE-2026-20831EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  45. 7.0CVE-2026-20816EPSS 2.4%

    Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-20809EPSS 0.4%

    Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.

  47. 5.3CVE-2026-22701EPSS 0.1%

    filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permiss…

  48. 6.4CVE-2025-47344EPSS 0.06%

    Memory corruption while handling sensor utility operations.

  49. 6.4CVE-2025-47332EPSS 0.06%

    Memory corruption while processing a config call from userspace.

  50. 4.4CVE-2025-53594EPSS 0.1%

    A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have alread…