CWE-362: Race Condition vulnerabilities

CVE-2026-77894 is a race condition vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related versions. It allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources concurrently. The vulnerability has been assigned a high severity score and has official patches available from Microsoft.

CVE-2026-70582 is a race condition vulnerability in Windows Management Instrumentation on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-69448 is a race condition vulnerability in the Windows Bluetooth Service on Windows 10 Version 21H2 and related builds. It allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.

CVE-2026-69404 is a race condition vulnerability in the Windows TCP/IP stack affecting multiple Windows 10 versions including Version 1607. It allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity score and has been officially fixed in specific Windows 10 builds.

CVE-2026-68824 is a race condition vulnerability in Windows Connected User Experiences and Telemetry on Windows 10 Version 21H2 and related builds. It allows a local authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The issue has been officially fixed in multiple Windows 10 builds.

CVE-2026-50349 is a race condition vulnerability in the Windows Ancillary Function Driver for WinSock affecting multiple versions of Microsoft Windows 10, including Version 1607. It allows an authorized local attacker to elevate privileges due to improper synchronization during concurrent execution using a shared resource. The vulnerability has a high severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-69782 is a race condition vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. It involves concurrent execution using a shared resource with improper synchronization, which could allow an unauthorized attacker to execute code remotely over the network. The vulnerability has a high severity with a CVSS score of 8.1. Official patches have been released to address this issue in multiple affected Windows versions.

CVE-2026-70091 is a race condition vulnerability in the Windows DNS component affecting multiple versions of Microsoft Windows including Windows 10 Version 1607. The flaw allows an unauthorized attacker to cause a denial of service over a network by exploiting improper synchronization during concurrent execution using a shared resource. This vulnerability has a medium severity rating and has been officially fixed in specific Windows updates.

A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to cause a denial of service or disclose sensitive information. This issue affects Bifrost GPU Kernel Driver: from r12p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r19p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

CVE-2026-58616 is a race condition vulnerability in the Copilot Chat feature of Microsoft Edge (Chromium-based) that allows an authorized attacker to disclose information over a network. The flaw arises from improper synchronization during concurrent execution using a shared resource. Microsoft has issued official fixes in versions 152.0.4191.52 and 152.0.4191.53 to address this issue.

CVE-2026-59324 is a high-severity race condition vulnerability in Spring Integration affecting multiple versions including 5.5.21 and earlier, 6.4.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The issue occurs when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads, causing concurrent requests on the same FluxMessageChannel subscription to incorrectly share reply headers from the most recently consumed upstream message.

CVE-2026-59321 is a medium severity race condition vulnerability in Spring Integration where a single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that are not thread-safe (THREADING=null), concurrent message processing can corrupt internal engine state, potentially causing leakage of one message's payload or headers into another or causing exceptions during script evaluation. This affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.x, 6.5.x, 7.0.x, and 7.1.0.

CVE-2026-45404 is a race condition vulnerability in the OpenTelemetry-Go library affecting versions from 0.11.0 up to but not including 1.45.0. The issue arises from an unsynchronized map used in the OpenTracing bridge's bridgeSpan, which can cause concurrent read/write operations leading to a runtime panic. This can terminate the process and cause a denial of service. The vulnerability is fixed in version 1.45.0.

A race condition vulnerability (CWE-362) exists in Tor versions from 0.3.5.3-alpha up to but not including 0.4.9.11. This flaw allows a rendezvous point to potentially man-in-the-middle and impersonate the onion service a client is attempting to reach. The vulnerability has a high severity with a CVSS score of 8.9.

HCL IntelliOps Event Management (IEM) version 1.4.0 contains a race condition vulnerability (CWE-362) that allows concurrent execution using a shared resource with improper synchronization. This timing window can enable an attacker to modify the resource, leading to unpredictable behavior. The vulnerability has a medium severity with a CVSS score of 5.9 and impacts the integrity of the system without affecting confidentiality or availability.

CVE-2026-62727 is a race condition vulnerability in the Windows Telephony Service affecting multiple versions of Microsoft Windows 10, including Version 1607 and later builds. This flaw allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity rating and has been officially fixed in specific Windows builds.

CVE-2026-19506 is a race condition vulnerability in the RDK-B WebUI component of RDK, specifically in the check.jst file of version rdkb-2025q4-kirkstone.04.10.26. This flaw allows remote attackers to gain unauthorized access by exploiting concurrent authentication requests that improperly synchronize shared authentication state. The vulnerability has a high severity with a CVSS score of 8.1.

Gotenberg versions from 8.10.0 up to but not including 8.33.0 contain a race condition vulnerability in the newContext function. This flaw allows unauthenticated remote attackers to cause a denial of service by triggering concurrent map writes, which crash the process. The issue is fixed in version 8.33.0.

CVE-2026-58088 is a race condition vulnerability in FreeBSD's ELF core dump code. The flaw arises because the code counts dumpable VM map entries and allocates a buffer, then iterates again to populate program headers. A process sharing the address space via rfork(2) can modify the map between these passes, causing an out-of-bounds write on the kernel heap. This can be triggered by an unprivileged local user sharing an address space with a process that dumps core, potentially leading to privilege escalation.