VYPR

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

BaseIncompleteLikelihood: Medium

Description

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-27 · CAPEC-29

CVEs mapped to this weakness (741)

page 14 of 38
  • CVE-2025-59261HigOct 14, 2025
    risk 0.46cvss 7.0epss 0.00

    Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  • CVE-2025-54093HigSep 9, 2025
    risk 0.46cvss 7.0epss 0.00

    Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  • CVE-2025-53788HigAug 12, 2025
    risk 0.46cvss 7.0epss 0.00

    Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

  • CVE-2025-53134HigAug 12, 2025
    risk 0.46cvss 7.0epss 0.00

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  • CVE-2025-50158HigAug 12, 2025
    risk 0.46cvss 7.0epss 0.00

    Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally.

  • CVE-2025-23279HigAug 2, 2025
    risk 0.46cvss 7.0epss 0.00

    NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, denial of service,…

  • CVE-2025-38461HigJul 25, 2025
    risk 0.46cvss 7.0epss 0.00

    In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_local_transport();…

  • CVE-2025-21191HigApr 8, 2025
    risk 0.46cvss 7.0epss 0.00

    Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.

  • CVE-2025-24036HigFeb 11, 2025
    risk 0.46cvss 7.0epss 0.00

    Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

  • CVE-2024-48322HigNov 11, 2024
    risk 0.46cvss 8.1epss 0.01

    UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.

  • CVE-2024-50234HigNov 9, 2024
    risk 0.46cvss 7.0epss 0.00

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn't being cleared out before interrupts…

  • CVE-2024-50592HigNov 8, 2024
    risk 0.46cvss 7.0epss 0.00

    An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service…

  • CVE-2024-43511HigOct 8, 2024
    risk 0.46cvss 7.0epss 0.00

    Windows Kernel Elevation of Privilege Vulnerability

  • CVE-2024-39425HigAug 14, 2024
    risk 0.46cvss 7.0epss 0.00

    Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to…

  • CVE-2024-39420HigAug 14, 2024
    risk 0.46cvss 7.0epss 0.03

    Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This…

  • CVE-2024-27238HigJul 15, 2024
    risk 0.46cvss 7.1epss 0.00

    Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access.

  • CVE-2024-35265HigJun 11, 2024
    risk 0.46cvss 7.0epss 0.00

    Windows Perception Service Elevation of Privilege Vulnerability

  • CVE-2024-30099HigJun 11, 2024
    risk 0.46cvss 7.0epss 0.01

    Windows Kernel Elevation of Privilege Vulnerability

  • CVE-2024-30084HigJun 11, 2024
    risk 0.46cvss 7.0epss 0.06

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

  • CVE-2021-47280HigMay 21, 2024
    risk 0.46cvss 7.0epss 0.00

    In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drm_getunique() There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving file_priv->master prior to locking the device's master mutex. An example can…