CWE-362: Race Condition vulnerabilities

CVE-2025-33235 is a high-severity race condition vulnerability in the NVIDIA Resiliency Extension for Linux, specifically in its checkpointing core. This flaw allows an attacker with limited privileges and local access to exploit improper synchronization of shared resources, potentially leading to information disclosure, data tampering, denial of service, or privilege escalation. The vulnerability affects versions prior to 0.5.0 and 0.4.1. Exploitation does not require user interaction but does require local access with some privileges. No known exploits are currently in the wild. European organizations using NVIDIA Resiliency Extension in Linux environments should prioritize patching once updates are available and implement strict access controls to mitigate risk.

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0.

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.

CVE-2025-64313 is a medium-severity denial of service (DoS) vulnerability in Huawei HarmonyOS affecting versions 5.0.1, 5.1.0, and 6.0.0. It arises from a race condition (CWE-362) in the office service component due to improper synchronization of shared resources. Exploitation requires local access with low privileges and some user interaction, potentially causing service unavailability. No known public exploits exist yet.

CVE-2025-58316 is a high-severity denial-of-service (DoS) vulnerability in Huawei HarmonyOS affecting versions 5.0.1, 5.1.0, and 6.0.0. It stems from a race condition (CWE-362) in the video-related system service module due to improper synchronization of shared resources. Exploitation requires local access and no user interaction or privileges, potentially causing system unavailability. No known exploits are currently in the wild.

CVE-2025-58303 is a high-severity race condition vulnerability in Huawei HarmonyOS affecting the screen recording framework. It involves a use-after-free (UAF) flaw caused by improper synchronization during concurrent execution of shared resources. Exploitation can lead to significant impacts on system confidentiality, integrity, and availability without requiring user interaction or privileges. The vulnerability affects multiple HarmonyOS versions (5.0.1, 5.1.0, and 6.0.0).

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.103+ * 24.18.195+ * 25.0.72+ * 25.6.60+ * 25.8.42+ * 25.10.22+