CWE-362: Race Condition vulnerabilities

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

FreeRDP server versions before 3.31.0 have a use-after-free vulnerability in the DRDYNVC parser caused by improper synchronization. Authenticated clients can exploit a race condition between AUDIN channel closure messages and DRDYNVC data parsing, leading to heap-use-after-free when accessing freed channel objects. This vulnerability is tracked as CVE-2026-91947 and has a high severity rating.

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.

CVE-2026-85892 is a race condition vulnerability in Microsoft Edge (Chromium-based) that allows a local authorized attacker to elevate privileges. The flaw arises from improper synchronization during concurrent execution using a shared resource. This vulnerability affects versions from 1.0.0.0 up to but not including 152.0.4191.66. A fix is available in version 152.0.4191.66.

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.

CVE-2026-73005 is a use-after-free vulnerability in Windows Authentication Methods affecting Windows 10 Version 1607 and later builds up to specific patched versions. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed by Microsoft in multiple updates.

CVE-2026-69441 is a race condition vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources concurrently. The flaw affects multiple Windows 10 builds and some earlier versions, but fixed versions have been released by Microsoft.

CVE-2026-69710 is a race condition vulnerability in Windows Hello on Microsoft Windows 10 Version 21H2 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for this vulnerability.

CVE-2026-69799 is a race condition vulnerability in Windows Hello on Microsoft Windows 10 Version 21H2 and related builds. It allows a locally authorized attacker to elevate privileges due to improper synchronization during concurrent execution of shared resources. The vulnerability has a high severity score of 7.8 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-69792 is a race condition vulnerability in the Windows Win32K component of Microsoft Windows 10 Version 1607 and later versions. It allows a local authorized attacker to bypass a security feature by exploiting improper synchronization during concurrent execution using a shared resource. The vulnerability has a medium severity score of 4.7 and does not impact confidentiality or availability but can impact integrity. Microsoft has released official fixes for all affected versions.

CVE-2026-69682 is a use-after-free vulnerability in the Windows Host Guardian Service on Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and affects multiple Windows 10 versions prior to specific fixed releases. Microsoft has issued official fixes for all affected versions.

CVE-2026-69581 is a use-after-free vulnerability in the Windows Device Association Service affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. An official fix is available and has been released for all affected versions.

CVE-2026-69398 is a race condition vulnerability in the Windows Bluetooth Service on Windows 10 Version 1809 and related builds. It allows a local authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The flaw affects multiple Windows 10 builds prior to specific patched versions. Microsoft has released official fixes for all affected versions.

CVE-2026-69385 is a race condition vulnerability in the Windows TCP/IP stack affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows a locally authorized attacker to elevate privileges due to improper synchronization during concurrent execution of shared resources. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-69364 is a race condition vulnerability in the Windows Print Spooler components affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to elevate privileges over a network by exploiting improper synchronization during concurrent execution using shared resources. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-69319 is a race condition vulnerability in the Windows USB Video Driver affecting multiple versions of Microsoft Windows 10, including version 1607 and later builds. This flaw allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-68840 is a race condition vulnerability in the Windows USB Driver affecting multiple Windows 10 versions including 1607 and later builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity score and has been officially fixed in specific Windows updates.

CVE-2026-69827 is a race condition vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. It allows an unauthorized attacker to execute code remotely over a network due to improper synchronization when accessing shared resources. The vulnerability affects multiple Windows versions and has been assigned a high severity score. Official patches have been released to address this issue.