CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
baseThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (1062)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-38352US | —OT critical | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
If an exiting non-autor… | ||||
| CVE-2025-22224US | high8.2OT critical | KEV | ||
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges… | ||||
| CVE-2024-30088US | —OT critical | KEV | ||
Windows Kernel Elevation of Privilege Vulnerability | ||||
| CVE-2022-48618US | high7.0OT critical | KEV | ||
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write… | ||||
| CVE-2023-35311US | —OT critical | KEV | ||
Microsoft Outlook Security Feature Bypass Vulnerability | ||||
| CVE-2015-3246US | high7.2OT critical | KEV | ||
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denia… | ||||
| CVE-2022-36980US | high8.1 | — | ||
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vu… | ||||
| CVE-2024-0132US | high8.3 | Exploit | ||
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container i… | ||||
| CVE-2025-34027US | critical9.0 | — | ||
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative… | ||||
| CVE-2004-0594US | medium5.1 | Exploit | ||
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute… | ||||
| CVE-2020-1337US | high7.2 | Exploit | ||
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited… | ||||
| CVE-2021-32708US | high8.1 | Exploit | ||
Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this c… | ||||
| CVE-2019-0836US | high7.8 | Exploit | ||
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE I… | ||||
| CVE-2018-8584US | high7.8 | Exploit | ||
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability… | ||||
| CVE-2017-0412US | high7.8 | Exploit | ||
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This… | ||||
| CVE-2017-0411US | high7.8 | Exploit | ||
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This… | ||||
| CVE-2021-3899US | high7.8 | Exploit | ||
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root. | ||||
| CVE-2024-27983US | — | Exploit | ||
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave so… | ||||
| CVE-2026-25052US | critical9.9 | — | ||
n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to… | ||||
| CVE-2019-5421US | critical9.8 | — | ||
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#incre… | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan