CWE-362— Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.— MITRE CWE catalog
2,289 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-362page 45 of 46
- CVE-2026-50305HIGHCVSS 7.8EG 7.82026-07-14
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- CVE-2026-50317HIGHCVSS 7.0EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Operating Systems allows an authorized attacker to elevate privileges locally.
- CVE-2026-50321HIGHCVSS 7.0EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-50322HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
- CVE-2026-50345HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
- CVE-2026-50348HIGHCVSS 8.1EG 8.12026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-50356HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
- CVE-2026-50361HIGHCVSS 7.8EG 7.82026-07-14
Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- CVE-2026-50369HIGHCVSS 8.8EG 8.82026-07-14
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50371HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows LUAFV allows an authorized attacker to elevate privileges locally.
- CVE-2026-50378HIGHCVSS 7.0EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Key Guard allows an authorized attacker to elevate privileges locally.
- CVE-2026-50379HIGHCVSS 7.5EG 7.52026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50384HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clip Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-50385HIGHCVSS 8.8EG 8.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
- CVE-2026-50398HIGHCVSS 7.5EG 8.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50403HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
- CVE-2026-50404HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally.
- CVE-2026-50414HIGHCVSS 8.8EG 8.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50427HIGHCVSS 7.8EG 7.82026-07-14
Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally.
- CVE-2026-50440HIGHCVSS 7.0EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-50450HIGHCVSS 7.0EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-50452HIGHCVSS 8.1EG 8.12026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-50457HIGHCVSS 7.8EG 7.82026-07-14
Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally.
- CVE-2026-50458HIGHCVSS 7.8EG 7.82026-07-14
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
- CVE-2026-50460HIGHCVSS 8.1EG 8.12026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-50503HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
- CVE-2026-50667HIGHCVSS 7.8EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.
- CVE-2026-50669HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-50672HIGHCVSS 7.0EG 7.02026-07-14
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.
- CVE-2026-50676HIGHCVSS 7.0EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally.
- CVE-2026-50677HIGHCVSS 7.8EG 7.82026-07-14
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
- CVE-2026-50689HIGHCVSS 7.8EG 7.82026-07-14
Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-51082HIGHCVSS 7.2EG 7.22026-07-17
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PV…
- CVE-2026-5120HIGHCVSS 8.1EG 8.12026-07-01
A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.
- CVE-2026-52991HIGHCVSS 7.8EG 7.82026-06-24
In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of…
- CVE-2026-53008MEDIUMCVSS 4.7EG 4.72026-06-24
In the Linux kernel, the following vulnerability has been resolved: ice: fix race condition in TX timestamp ring cleanup Fix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map() that can cause a NULL pointer dereference. …
- CVE-2026-53020HIGHCVSS 7.8EG 7.82026-06-24
In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race condition in TLB sync During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP su…
- CVE-2026-53050HIGHCVSS 7.8EG 7.82026-06-24
In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_releas…
- CVE-2026-53086CRITICALCVSS 9.8EG 9.82026-06-24
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes ma…
- CVE-2026-53108MEDIUMCVSS 4.7EG 4.72026-06-24
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is …
- CVE-2026-53352MEDIUMCVSS 4.7EG 4.72026-07-01
In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a multi-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop() sets JOBCTL_ST…
- CVE-2026-53517HIGHCVSS 8.1EG 8.12026-07-07
Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke,…
- CVE-2026-53518HIGHCVSS 8.1EG 8.12026-07-07
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code throug…
- CVE-2026-54107HIGHCVSS 8.8EG 8.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
- CVE-2026-54111HIGHCVSS 7.0EG 7.02026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-54112HIGHCVSS 7.8EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
- CVE-2026-54125HIGHCVSS 7.8EG 7.82026-07-14
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
- CVE-2026-54229HIGHCVSS 7.0EG 7.02026-06-13
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even whi…
- CVE-2026-54497MEDIUMCVSS 6.8EG 6.82026-07-15
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base instances retain render-scoped objects across calls to render_in; if the same co…
- CVE-2026-54778MEDIUMCVSS 6.2EG 6.22026-06-19
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concur…
Map vulnerabilities like CWE-362 to your infrastructure
EchelonGraph correlates every CVE — across CWE-362 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →