CWE-362— Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.— MITRE CWE catalog

2,711 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-362page 29 of 55

CVE-2013-2906MEDIUMCVSS v2 6.8EG 6.8
2013-10-02
Multiple race conditions in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to threading…
CVE-2013-2847MEDIUMCVSS v2 6.8EG 6.8
2013-05-22
Race condition in the workers implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via unknown vectors.
CVE-2013-0900MEDIUMCVSS v2 6.8EG 6.8
2013-02-23
Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly…
CVE-2013-0893MEDIUMCVSS v2 6.8EG 6.8
2013-02-23
Race condition in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media.
CVE-2012-5119MEDIUMCVSS v2 6.8EG 6.8
2012-11-07
Race condition in Pepper, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to buffers.
CVE-2012-2868MEDIUMCVSS v2 6.8EG 6.8
2012-08-31
Race condition in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving improper interaction between worker processes and an XMLHttpRequest (a…
CVE-2011-3878MEDIUMCVSS v2 6.8EG 6.8
2011-10-25
Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker process initialization.
CVE-2011-2835MEDIUMCVSS v2 6.8EG 6.8
2011-09-19
Race condition in Google Chrome before 14.0.835.163 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the certificate cache.
CVE-2011-1444MEDIUMCVSS v2 6.8EG 6.8
2011-05-03
Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-1305MEDIUMCVSS v2 6.8EG 6.8
2011-05-03
Race condition in Google Chrome before 11.0.696.57 on Linux and Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to linked lists and a database.
CVE-2011-0784MEDIUMCVSS v2 6.8EG 6.8
2011-02-04
Race condition in Google Chrome before 9.0.597.84 allows remote attackers to execute arbitrary code via vectors related to audio.
CVE-2010-2793MEDIUMCVSS v2 6.8EG 6.8
2010-12-08
Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors…
CVE-2010-1888MEDIUMCVSS v2 6.8EG 6.8
2010-08-11
Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."
CVE-2010-1151MEDIUMCVSS v2 6.8EG 6.8
2010-04-20
Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application fo…
CVE-2009-4440MEDIUMCVSS v2 6.8EG 6.8
2009-12-28
Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend conn…
CVE-2009-3447MEDIUMCVSS v2 6.8EG 6.8
2009-09-29
Unrestricted file upload vulnerability in RADactive I-Load before 2008.2.5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, and then sending a request for a predictable filename during a…
CVE-2008-3646MEDIUMCVSS v2 6.8EG 6.8
2008-10-10
The Postfix configuration file in Mac OS X 10.5.5 causes Postfix to be network-accessible when mail is sent from a local command-line tool, which allows remote attackers to send mail to local Mac OS X users.
CVE-2007-1249MEDIUMCVSS v2 6.8EG 6.8
2007-03-03
MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components.
CVE-2026-19571MEDIUMCVSS 6.7EG 6.7
2026-10-09
The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data->in_msg and only afte…
CVE-2026-58716MEDIUMCVSS 6.7EG 6.7
2026-09-15
In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-71968MEDIUMCVSS 6.7EG 6.7
2026-08-10
OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory …
CVE-2025-55226MEDIUMCVSS 6.7EG 6.7
2025-09-09
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally.
CVE-2025-49743MEDIUMCVSS 6.7EG 6.7
2025-08-12
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVE-2025-22830MEDIUMCVSS 6.7EG 6.7
2025-08-12
APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availab…
CVE-2025-54629MEDIUMCVSS 6.7EG 6.7
2025-08-06
Race condition issue occurring in the physical page import process of the memory management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
CVE-2025-1351MEDIUMCVSS 6.7EG 6.7
2025-07-07
IBM Storage Virtualize 8.5, 8.6, and 8.7 products could allow a user to escalate their privileges to that of another user logging in at the same time due to a race condition in the login function.
CVE-2024-58048MEDIUMCVSS 6.7EG 6.7
2025-03-04
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2023-33951MEDIUMCVSS 6.7EG 6.7
2023-07-24
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a loca…
CVE-2023-28142MEDIUMCVSS 6.7EG 6.7
2023-04-18
A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to escalate privileges limited on the local machine during uninstallation of the Qualys Cloud Agent…
CVE-2022-21774MEDIUMCVSS 6.7EG 6.7
2022-07-06
In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641447; …
CVE-2022-21773MEDIUMCVSS 6.7EG 6.7
2022-07-06
In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641388; …
CVE-2022-21772MEDIUMCVSS 6.7EG 6.7
2022-07-06
In TEEI driver, there is a possible type confusion due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06493842; …
CVE-2022-21771MEDIUMCVSS 6.7EG 6.7
2022-07-06
In GED driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641585; I…
CVE-2021-30313MEDIUMCVSS 6.7EG 6.7
2022-01-13
Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapd…
CVE-2021-1958MEDIUMCVSS 6.7EG 6.7
2021-09-09
A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables
CVE-2019-6133MEDIUMCVSS 6.7EG 6.7
2019-01-11
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polk…
CVE-2017-11823MEDIUMCVSS 6.7EG 6.7
2017-10-13
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security feature bypass by the way it handles Windows PowerShell sessions, aka "Microsoft Windows Security Feature Bypass".
CVE-2015-5191MEDIUMCVSS 6.7EG 6.7
2017-07-28
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/…
CVE-2016-1267MEDIUMCVSS 6.7EG 6.7
2016-04-15
Race condition in the RPC functionality in Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D39, 13.3 b…
CVE-2025-66326MEDIUMCVSS 4.7EG 6.7
2025-12-08
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-61920MEDIUMCVSS 6.6EG 6.6
2026-08-11
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.
CVE-2025-48880MEDIUMCVSS 6.6EG 6.6
2025-05-30
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, when an administrative account is a deleting a user, there is the the possibility of a race condition occurring. This issue has been patched in version…
CVE-2025-20039MEDIUMCVSS 6.6EG 6.6
2025-05-13
Race condition for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVE-2025-21101MEDIUMCVSS 6.6EG 6.6
2025-01-15
Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit this vulnerability during installation, leading to arbitrary folder or file deletion.
CVE-2023-35351MEDIUMCVSS 6.6EG 6.6
2023-07-11
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
CVE-2023-35346MEDIUMCVSS 6.6EG 6.6
2023-07-11
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-35310MEDIUMCVSS 6.6EG 6.6
2023-07-11
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-28308MEDIUMCVSS 6.6EG 6.6
2023-04-11
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-28307MEDIUMCVSS 6.6EG 6.6
2023-04-11
Windows DNS Server Remote Code Execution Vulnerability
CVE-2023-28306MEDIUMCVSS 6.6EG 6.6
2023-04-11
Windows DNS Server Remote Code Execution Vulnerability

Map vulnerabilities like CWE-362 to your infrastructure

EchelonGraph correlates every CVE — across CWE-362 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →