CWE-362: Race Condition vulnerabilities

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CVE-2026-34862 is a race condition vulnerability in the power consumption statistics module of Huawei HarmonyOS version 6.0.0. Exploiting this flaw may impact system availability. The vulnerability is classified under CWE-362, indicating improper synchronization during concurrent execution using shared resources. The CVSS score is 6.3, reflecting a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-34861 is a race condition vulnerability in the thermal management module of Huawei HarmonyOS version 6.0.0. This flaw involves improper synchronization during concurrent execution using shared resources. Exploiting this vulnerability may impact system availability. The CVSS score is 6.3, indicating a medium severity level. No official patch or remediation guidance has been provided by Huawei as of the publication date. There are no known exploits in the wild currently.

CVE-2026-34858 is a use-after-free (UAF) vulnerability in the communication module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. It is caused by a race condition due to improper synchronization when accessing shared resources. Successful exploitation may impact system availability but does not affect confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 4.1, indicating medium severity.

CVE-2026-34857 is a use-after-free (UAF) vulnerability in the communication module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. It is caused by improper synchronization leading to a race condition (CWE-362). Successful exploitation may impact system availability. The vulnerability has a CVSS 3.1 base score of 4.7, indicating medium severity.

CVE-2026-34849 is a use-after-free (UAF) vulnerability in the screen management module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. It is classified as a race condition (CWE-362) caused by improper synchronization during concurrent execution using shared resources. The vulnerability may impact system availability if successfully exploited. The CVSS v3.1 base score is 2.5, indicating low severity.

CVE-2026-34856 is a use-after-free (UAF) vulnerability in the communication module of Huawei HarmonyOS version 6.0.0. It is caused by a race condition due to improper synchronization when accessing shared resources. Exploitation of this vulnerability may impact system availability. The vulnerability has a high severity rating with a CVSS score of 7.3. No official patch or remediation guidance has been provided by the vendor at this time. There are no known exploits in the wild currently.

CVE-2026-34851 is a race condition vulnerability in the event notification module of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Exploitation may impact system availability but does not affect confidentiality or integrity. The vulnerability has a low severity rating with a CVSS score of 2.2. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-34850 is a race condition vulnerability in the notification service of Huawei HarmonyOS versions 5.1.0 and 6.0.0. Exploitation of this flaw may impact system availability but does not affect confidentiality or integrity. The vulnerability has a low severity rating and a CVSS score of 1.9. There is no information about available patches or official remediation from the vendor. No known exploits are reported in the wild.

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.