CWE-362— Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.— MITRE CWE catalog

2,715 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-362page 37 of 55

CVE-2018-1000004MEDIUMCVSS 5.9EG 5.9
2018-01-16
In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition.
CVE-2017-14955MEDIUMCVSS 5.9EG 5.9
2017-10-02
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
CVE-2017-11353MEDIUMCVSS 5.9EG 5.9
2017-07-17
yadm (yet another dotfile manager) 1.10.0 has a race condition (related to the behavior of git commands in setting permissions for new files and directories), which potentially allows access to SSH and PGP keys.
CVE-2017-8242MEDIUMCVSS 5.9EG 5.9
2017-06-13
In all Android releases from CAF using the Linux kernel, a race condition exists in a QTEE driver potentially leading to an arbitrary memory write.
CVE-2017-6512MEDIUMCVSS 5.9EG 5.9
2017-06-01
Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.
CVE-2016-10027MEDIUMCVSS 5.9EG 5.9
2017-01-12
Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by strip…
CVE-2016-4955MEDIUMCVSS 5.9EG 5.9
2016-07-05
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC …
CVE-2015-8878MEDIUMCVSS 5.9EG 5.9
2016-05-22
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application …
CVE-2012-3552MEDIUMCVSS 5.9EG 5.9
2012-10-03
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the ha…
CVE-2010-0021MEDIUMCVSS 5.9EG 5.9
2010-02-10
Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allow remote attackers to cause a denial of service (system hang) …
CVE-2016-4247MEDIUMCVSS 5.3EG 5.9
2016-07-13
Race condition in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to obtain sensitive information via unspecified vectors.
CVE-2026-28545MEDIUMCVSS 4.7EG 5.9
2026-03-05
Race condition vulnerability in the printing module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2018-1121MEDIUMCVSS 3.9EG 5.9
2018-06-13
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the p…
CVE-2026-61079MEDIUMCVSS 5.8EG 5.8
2026-07-21
Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the i…
CVE-2026-48982MEDIUMCVSS 5.8EG 5.8
2026-06-18
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when updating a one-time pad file, a temporary file is created using open() without the O_EXCL flag. Without O_EXCL, the create …
CVE-2026-27189MEDIUMCVSS 5.8EG 5.8
2026-02-21
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concur…
CVE-2024-20509MEDIUMCVSS 5.8EG 5.8
2024-10-02
A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to hijack an AnyConnect VPN session or cause a denial of service (Do…
CVE-2014-2243MEDIUMCVSS v2 5.8EG 5.8
2014-03-02
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to o…
CVE-2011-0990MEDIUMCVSS v2 5.8EG 5.8
2011-04-13
Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to trigger a buffer overflow and modify internal data s…
CVE-2009-4129MEDIUMCVSS v2 5.8EG 5.8
2009-12-14
Race condition in Mozilla Firefox allows remote attackers to produce a JavaScript message with a spoofed domain association by writing the message in between the document request and document load for a web page in a different domain.
CVE-2009-3110MEDIUMCVSS v2 5.8EG 5.8
2009-09-08
Race condition in the file transfer functionality in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 allows remote attackers to read sensitive files and prevent client updates by connecting to the file transfer port bef…
CVE-2008-0058MEDIUMCVSS v2 5.8EG 5.8
2008-03-18
Race condition in the NSURLConnection cache management functionality in Foundation for Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via unspecified manipulations that cause messages to be sent to a deallocated o…
CVE-2008-0059MEDIUMCVSS v2 5.8EG 5.8
2008-03-18
Race condition in NSXML in Foundation for Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a crafted XML file, related to "error handling logic."
CVE-2007-5154MEDIUMCVSS v2 5.8EG 5.8
2007-10-01
Session fixation vulnerability in Aipo and Aipo ASP 3.0.1.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2026-48066MEDIUMCVSS 5.7EG 5.7
2026-05-27
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a process-wide static pointer that is written on every PAM invocation with the address of a stack-local variable. This vi…
CVE-2024-47827MEDIUMCVSS 5.7EG 5.7
2024-10-28
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by an…
CVE-2024-2193MEDIUMCVSS 5.7EG 5.7
2024-03-15
A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbi…
CVE-2023-23039MEDIUMCVSS 5.7EG 5.7
2023-02-22
An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between v…
CVE-2021-35494MEDIUMCVSS 5.7EG 5.7
2021-10-12
The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - De…
CVE-2020-27825MEDIUMCVSS 5.7EG 5.7
2020-12-11
A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DO…
CVE-2020-15707MEDIUMCVSS 5.7EG 5.7
2020-07-29
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-…
CVE-2015-0632MEDIUMCVSS v2 5.7EG 5.7
2015-02-27
Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770.
CVE-2013-1935MEDIUMCVSS v2 5.7EG 5.7
2013-07-16
A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (ho…
CVE-2011-0695MEDIUMCVSS v2 5.7EG 5.7
2011-03-15
Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request…
CVE-2026-85639MEDIUMCVSS 5.6EG 5.6
2026-09-04
A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry Endpoint. Such manipulation of the argument vId leads to race condition. The attack…
CVE-2025-52993MEDIUMCVSS 5.6EG 5.6
2025-06-27
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; …
CVE-2024-36285MEDIUMCVSS 5.6EG 5.6
2025-02-12
Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2024-12747MEDIUMCVSS 5.6EG 5.6
2025-01-14
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a …
CVE-2024-36894MEDIUMCVSS 5.6EG 5.6
2024-05-30
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests su…
CVE-2024-32993MEDIUMCVSS 5.6EG 5.6
2024-05-14
Out-of-bounds access vulnerability in the memory module Impact: Successful exploitation of this vulnerability will affect availability.
CVE-2023-38537MEDIUMCVSS 5.6EG 5.6
2023-10-04
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.
CVE-2023-3301MEDIUMCVSS 5.6EG 5.6
2023-09-13
A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an asse…
CVE-2017-15038MEDIUMCVSS 5.6EG 5.6
2017-10-10
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.
CVE-2017-14317MEDIUMCVSS 5.6EG 5.6
2017-09-12
A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a D…
CVE-2026-65401MEDIUMCVSS 5.5EG 5.5
2026-09-14
A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
CVE-2026-28996MEDIUMCVSS 5.5EG 5.5
2026-05-11
A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5…
CVE-2025-64313MEDIUMCVSS 5.5EG 5.5
2025-11-28
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-43292MEDIUMCVSS 5.5EG 5.5
2025-09-15
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7, macOS Sequoia 15.7.2, macOS Tahoe 26. An app may be able to access sensitive user data.
CVE-2025-38290MEDIUMCVSS 5.5EG 5.5
2025-07-10
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath12k_core_halt() only reinitializes the "arvifs" list head. This will cause th…
CVE-2025-24493MEDIUMCVSS 5.5EG 5.5
2025-06-08
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition.

Map vulnerabilities like CWE-362 to your infrastructure

EchelonGraph correlates every CVE — across CWE-362 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →