CWE-362: Race Condition vulnerabilities

Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in UI Automation Manager (uiamanager.dll) allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2025-10263 is a critical race condition vulnerability in the Linux kernel on ARM processors, including Arm C1-Ultra and related cores. It involves improper synchronization during Translation Lookaside Buffer Invalidation (TLBI) operations when memory permissions change, allowing a local attacker to write to memory resources owned by higher privilege levels. This flaw can enable privilege escalation to kernel level or guest VM escape to the hypervisor, potentially leading to complete system compromise. Red Hat has acknowledged the issue and is working on fixes for affected products such as Red Hat OpenShift Container Platform 4.12.96. No known exploits are reported in the wild at this time.

A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.

CVE-2026-47741 is a race condition vulnerability in shopperlabs' shopper product prior to version 2.8.0. The issue occurs because the system creates an order before properly checking and incrementing the discount usage counter, allowing the discount's usage limit to be exceeded silently under concurrent checkout conditions. This results in orders being processed with discounts applied beyond their intended usage limits without alerting the merchant. The vulnerability has a medium severity with a CVSS score of 5.9 and is fixed in version 2.8.0.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, GDM, GNOME Shell). Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the deny_remote feature called the non-reentrant strtok(), which stores state in a single global pointer. If two authentications race, one thread's strtok() call can overwrite the other's in-progress tokenisation pointer, causing incorrect parsing of the tmux session data or the /proc environ scan that backs the remote-session detection logic. Additionally, pusb_tmux_get_client_tty() passed the raw pointer returned by getenv(TMUX) directly to strtok(). getenv() returns a pointer into the live process environment block; strtok() inserts NUL bytes into that block, permanently corrupting the TMUX variable for subsequent code running in the same process. In long-lived display managers this affects all future authentications in that process. The combined effect can cause deny_remote=true to return an incorrect decision for a remote session, or an incorrect decision for a local session, depending on thread interleaving. This vulnerability is fixed in 0.9.0.

CVE-2026-48066 is a race condition vulnerability in pam_usb versions prior to 0.9.1. The issue arises from a process-wide static pointer in src/log.c that is overwritten on every PAM invocation with the address of a stack-local variable, violating PAM's re-entrancy requirements. This creates a data race when multiple threads invoke the PAM stack concurrently. The vulnerability has a medium severity with a CVSS score of 5.7 and is fixed in version 0.9.1.

CVE-2026-45090 is a race condition vulnerability in hahwul dalfox versions prior to 2.13.0. The issue arises because two sequential worker stages write to the same results channel, which is closed after the first stage, causing the second stage to write to a closed channel. This triggers a Go runtime panic that crashes the dalfox process. In server mode, this crash can be remotely triggered by unauthenticated callers via the REST API if the default configuration is used without an API key and the attacker supplies POST-body data that is reflected by the target. The vulnerability is fixed in version 2.13.0.

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level variable is set and unexpired. It does not validate any value from the incoming HTTP request or bind the nonce to the admin's session. If the admin's auth.api.signUpEmail() call fails before the before hook fires (e.g. BetterAuth rejects a duplicate email at the validation layer), the nonce is set but never consumed. Any POST /api/auth/sign-up/email request that arrives during the remaining window registers successfully regardless of who sent it. An attacker who can observe or predict when the admin is creating users (must be a dupplicate user) can race the 10-second window to register an unauthorized account. This vulnerability is fixed in 0.9.7.

A race condition vulnerability (CWE-362) exists in the NVIDIA Display Driver for Linux kernel module affecting GeForce drivers prior to version 595.71.05. This flaw arises from improper synchronization when reordering compiler or processor memory instructions. Exploitation could result in a denial of service condition. The vulnerability has a medium severity with a CVSS score of 4.7. No known exploits are reported in the wild. Patch status is not confirmed as no official fix or vendor advisory is provided.

CVE-2026-43981 is a race condition vulnerability in the xyproto algernon web server versions prior to 1.17.6. The issue arises because a synchronization mutex protecting a shared Lua state is released too early, allowing concurrent requests to corrupt the Lua virtual machine state. This vulnerability has a high severity with a CVSS score of 8.2. The vulnerability is fixed in version 1.17.6 of algernon.

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.