CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2907 vulnerabilities reference this CWE, most recent first.
GHSA-Q9VP-R4Q6-9PF8
Vulnerability from github – Published: 2025-01-15 06:30 – Updated: 2025-01-15 06:30Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit this vulnerability during installation, leading to arbitrary folder or file deletion.
{
"affected": [],
"aliases": [
"CVE-2025-21101"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T05:15:09Z",
"severity": "MODERATE"
},
"details": "Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability.\nA local malicious user could potentially exploit this vulnerability during installation, leading to arbitrary folder or file deletion.",
"id": "GHSA-q9vp-r4q6-9pf8",
"modified": "2025-01-15T06:30:49Z",
"published": "2025-01-15T06:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21101"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000267927/dsa-2025-033"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QC76-HQ6C-MQFW
Vulnerability from github – Published: 2026-03-10 18:31 – Updated: 2026-03-10 18:31Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-24295"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-10T18:18:20Z",
"severity": "HIGH"
},
"details": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) in Windows Device Association Service allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-qc76-hq6c-mqfw",
"modified": "2026-03-10T18:31:20Z",
"published": "2026-03-10T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24295"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24295"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QC84-GQF4-9926
Vulnerability from github – Published: 2022-02-16 22:36 – Updated: 2025-02-04 17:30Impact
The affected versions of this crate incorrectly assumed that the alignment of {i,u}64 was always the same as Atomic{I,U}64.
However, the alignment of {i,u}64 on a 32-bit target can be smaller than Atomic{I,U}64.
This can cause the following problems:
- Unaligned memory accesses
- Data race
Crates using fetch_* methods with AtomicCell<{i,u}64> are affected by this issue.
32-bit targets without Atomic{I,U}64 and 64-bit targets are not affected by this issue.
32-bit targets with Atomic{I,U}64 and {i,u}64 have the same alignment are also not affected by this issue.
The following is a complete list of the builtin targets that may be affected. (last update: nightly-2022-02-11)
- armv7-apple-ios (tier 3)
- armv7s-apple-ios (tier 3)
- i386-apple-ios (tier 3)
- i586-unknown-linux-gnu
- i586-unknown-linux-musl
- i686-apple-darwin (tier 3)
- i686-linux-android
- i686-unknown-freebsd
- i686-unknown-haiku (tier 3)
- i686-unknown-linux-gnu
- i686-unknown-linux-musl
- i686-unknown-netbsd (tier 3)
- i686-unknown-openbsd (tier 3)
- i686-wrs-vxworks (tier 3)
Patches
This has been fixed in crossbeam-utils 0.8.7.
Affected 0.8.x releases have been yanked.
References
https://github.com/crossbeam-rs/crossbeam/pull/781
License
This advisory is in the public domain.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "crossbeam-utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23639"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-16T22:36:21Z",
"nvd_published_at": "2022-02-15T19:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThe affected versions of this crate incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. \n\nHowever, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`.\n\nThis can cause the following problems:\n\n- Unaligned memory accesses\n- Data race\n\nCrates using `fetch_*` methods with `AtomicCell\u003c{i,u}64\u003e` are affected by this issue.\n\n32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue.\n32-bit targets with `Atomic{I,U}64` and `{i,u}64` have the same alignment are also not affected by this issue.\n\nThe following is a complete list of the builtin targets that may be affected. (last update: nightly-2022-02-11)\n\n- armv7-apple-ios (tier 3)\n- armv7s-apple-ios (tier 3)\n- i386-apple-ios (tier 3)\n- i586-unknown-linux-gnu\n- i586-unknown-linux-musl\n- i686-apple-darwin (tier 3)\n- i686-linux-android\n- i686-unknown-freebsd\n- i686-unknown-haiku (tier 3)\n- i686-unknown-linux-gnu\n- i686-unknown-linux-musl\n- i686-unknown-netbsd (tier 3)\n- i686-unknown-openbsd (tier 3)\n- i686-wrs-vxworks (tier 3)\n\n([script to get list](https://gist.github.com/taiki-e/3c7891e8c5f5e0cbcb44d7396aabfe10))\n\n### Patches\n\nThis has been fixed in crossbeam-utils 0.8.7.\n\nAffected 0.8.x releases have been yanked.\n\n### References\n\nhttps://github.com/crossbeam-rs/crossbeam/pull/781 \n\n### License\n\nThis advisory is in the public domain.",
"id": "GHSA-qc84-gqf4-9926",
"modified": "2025-02-04T17:30:19Z",
"published": "2022-02-16T22:36:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-qc84-gqf4-9926"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23639"
},
{
"type": "WEB",
"url": "https://github.com/crossbeam-rs/crossbeam/pull/781"
},
{
"type": "PACKAGE",
"url": "https://github.com/crossbeam-rs/crossbeam"
},
{
"type": "WEB",
"url": "https://github.com/crossbeam-rs/crossbeam/releases/tag/crossbeam-utils-0.8.7"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2022-0041.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "crossbeam-utils Unsoundness of AtomicCell\u003c{i,u}64\u003e arithmetics on 32-bit targets that support Atomic{I,U}64"
}
GHSA-QC9V-792J-M4RX
Vulnerability from github – Published: 2025-10-01 00:30 – Updated: 2025-10-01 00:30Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, the Help Button, the About button, and the Help Button, leading to a transition out of kiosk mode into local administrative access. NOTE: the reporter indicates that the "behavior was observed sporadically" during "limited time on the client site," making it not "possible to gain more information about the specific kiosk mode crashing issue," and the only conclusion was "there appears to be some form of race condition." Accordingly, there can be doubt that a reproducible cybersecurity vulnerability was identified; sporadic software crashes can also be caused by a hardware fault on a single device (for example, transient RAM errors). The reporter also describes a variety of other issues, including initial access via USB because of the absence of a "lock-pick resistant locking solution for the External Controller PC cabinet," which is not a cybersecurity vulnerability (section 4.1.5 of the CNA Operational Rules). Finally, it is unclear whether the device or OS configuration was inappropriate, given that the risks are typically limited to insider threats within the mail operations room of a large company.
{
"affected": [],
"aliases": [
"CVE-2025-61792"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-30T23:15:29Z",
"severity": "MODERATE"
},
"details": "Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, the Help Button, the About button, and the Help Button, leading to a transition out of kiosk mode into local administrative access. NOTE: the reporter indicates that the \"behavior was observed sporadically\" during \"limited time on the client site,\" making it not \"possible to gain more information about the specific kiosk mode crashing issue,\" and the only conclusion was \"there appears to be some form of race condition.\" Accordingly, there can be doubt that a reproducible cybersecurity vulnerability was identified; sporadic software crashes can also be caused by a hardware fault on a single device (for example, transient RAM errors). The reporter also describes a variety of other issues, including initial access via USB because of the absence of a \"lock-pick resistant locking solution for the External Controller PC cabinet,\" which is not a cybersecurity vulnerability (section 4.1.5 of the CNA Operational Rules). Finally, it is unclear whether the device or OS configuration was inappropriate, given that the risks are typically limited to insider threats within the mail operations room of a large company.",
"id": "GHSA-qc9v-792j-m4rx",
"modified": "2025-10-01T00:30:17Z",
"published": "2025-10-01T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61792"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/from-folding-to-folded-hacking-high-volume-mailer-machines"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QCF3-QG3W-G99P
Vulnerability from github – Published: 2026-05-28 12:30 – Updated: 2026-06-11 03:30In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: fix kthread lifetime race between self-exit and external-stop
RSI driver use both self-exit(kthread_complete_and_exit) and external-stop (kthread_stop) when killing a kthread. Generally, kthread_stop() is called first, and in this case, no particular issues occur.
However, in rare instances where kthread_complete_and_exit() is called first and then kthread_stop() is called, a UAF occurs because the kthread object, which has already exited and been freed, is accessed again.
Therefore, to prevent this with minimal modification, you must remove kthread_stop() and change the code to wait until the self-exit operation is completed.
{
"affected": [],
"aliases": [
"CVE-2026-46187"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-28T10:16:34Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: fix kthread lifetime race between self-exit and external-stop\n\nRSI driver use both self-exit(kthread_complete_and_exit) and external-stop\n(kthread_stop) when killing a kthread. Generally, kthread_stop() is called\nfirst, and in this case, no particular issues occur.\n\nHowever, in rare instances where kthread_complete_and_exit() is called\nfirst and then kthread_stop() is called, a UAF occurs because the kthread\nobject, which has already exited and been freed, is accessed again.\n\nTherefore, to prevent this with minimal modification, you must remove\nkthread_stop() and change the code to wait until the self-exit operation\nis completed.",
"id": "GHSA-qcf3-qg3w-g99p",
"modified": "2026-06-11T03:30:23Z",
"published": "2026-05-28T12:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46187"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/16d9f674c619838bdeae42abc0929c9c5477ea1f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4ac3095da22fc50e51ec10c3b8323c21ab3e441a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f4c9b13c485abd0a2d2c97f9db339d1dd8e147f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f697813162d5f9151726a6d2bee82bffe4b0256"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f9a4ae8d2c198f01611ea376034c326ef43ab56"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95fcb436586dc3c2983537d557ac05bbc6a027f3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9dfe8a4458a063c6433526bc59112a169eee1aa3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/db57a1aa54ff68669781976e4edb045e09e2b65b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QCH9-X3VR-H45W
Vulnerability from github – Published: 2025-04-23 00:30 – Updated: 2025-04-23 15:30A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, this vulnerability may lead to local/cluster unauthorized access.
{
"affected": [],
"aliases": [
"CVE-2025-37088"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-22T22:15:17Z",
"severity": "HIGH"
},
"details": "A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, this vulnerability may lead to local/cluster unauthorized access.",
"id": "GHSA-qch9-x3vr-h45w",
"modified": "2025-04-23T15:30:57Z",
"published": "2025-04-23T00:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37088"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04749en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QF86-4QGW-7G49
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2025-04-12 12:32Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.
{
"affected": [],
"aliases": [
"CVE-2014-2672"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-04-01T06:35:00Z",
"severity": "HIGH"
},
"details": "Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.",
"id": "GHSA-qf86-4qgw-7g49",
"modified": "2025-04-12T12:32:04Z",
"published": "2022-05-13T01:18:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2672"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/21f8aaee0c62708654988ce092838aa7df4d25d8"
},
{
"type": "WEB",
"url": "https://bugzilla.kernel.org/show_bug.cgi?id=70551"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.15"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21f8aaee0c62708654988ce092838aa7df4d25d8"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=21f8aaee0c62708654988ce092838aa7df4d25d8"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/57468"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/03/30/5"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/66492"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QF89-P9HJ-7H7G
Vulnerability from github – Published: 2022-05-02 03:46 – Updated: 2022-05-02 03:46Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
{
"affected": [],
"aliases": [
"CVE-2009-3547"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-11-04T15:30:00Z",
"severity": "HIGH"
},
"details": "Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.",
"id": "GHSA-qf89-p9hj-7h7g",
"modified": "2022-05-02T03:46:19Z",
"published": "2022-05-02T03:46:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3547"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.html"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1550.html"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1548.html"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1541.html"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1540.html"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9327"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7608"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11513"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=530490"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2009-3547"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1672"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1588"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1587"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1550"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1548"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1541"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2009:1540"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3960243e55320d74195fb85c975e0a8cc4466c"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ad3960243e55320d74195fb85c975e0a8cc4466c"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.vmware.com/pipermail/security-announce/2010/000082.html"
},
{
"type": "WEB",
"url": "http://lkml.org/lkml/2009/10/14/184"
},
{
"type": "WEB",
"url": "http://lkml.org/lkml/2009/10/21/42"
},
{
"type": "WEB",
"url": "http://marc.info/?l=oss-security\u0026m=125724568017045\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37351"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38017"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38794"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38834"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc6"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:329"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1672.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/512019/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/36901"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-864-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/0528"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QFC8-J6V5-57WR
Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-12 18:30Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-34351"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T18:17:09Z",
"severity": "HIGH"
},
"details": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) in Windows TCP/IP allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-qfc8-j6v5-57wr",
"modified": "2026-05-12T18:30:43Z",
"published": "2026-05-12T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34351"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34351"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QFF4-M3J5-XCV5
Vulnerability from github – Published: 2026-05-19 15:31 – Updated: 2026-06-02 15:31Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location (DIR) under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
{
"affected": [],
"aliases": [
"CVE-2026-42099"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-19T14:16:42Z",
"severity": "HIGH"
},
"details": "Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location\u00a0(__DIR__)\u00a0under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.\n\n\n\n\n\n\n\n\nThe vendor was notified early about this vulnerability, but didn\u0027t respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.",
"id": "GHSA-qff4-m3j5-xcv5",
"modified": "2026-06-02T15:31:54Z",
"published": "2026-05-19T15:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42099"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2026/05/CVE-2026-42096"
},
{
"type": "WEB",
"url": "https://efigo.pl/blog/CVE-2026-42096"
},
{
"type": "WEB",
"url": "https://sparxsystems.com/products/procloudserver"
},
{
"type": "WEB",
"url": "https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.