Race Condition
Monthly
FreeBSD's bhyve hypervisor contains a guest-to-host race condition and input-validation flaw in its framebuffer/VNC device model, allowing a guest with existing code execution to crash the bhyve process or potentially execute code in the host userspace context, subject to bhyve's Capsicum sandbox. Only VMs configured with the fbuf framebuffer/VNC device are exposed, affecting FreeBSD 14.4 before p11, 14.5 before p2, and 15.1 before p5, while headless or serial-only guests are not affected by this path. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring guest-level privilege and a difficult timing race, and no public exploit identified at time of analysis.
FreeBSD's bhyve hypervisor xHCI (USB 3) device model can be driven into a guest-to-host memory race by a malicious privileged guest: the emulated controller neither validates nor caches the guest-supplied event ring size, re-reading it from guest memory on each use, and loads Transfer Request Block (TRB) fields without guarding against concurrent modification by the guest. Winning that race (CVSS 3.1 AV:L/AC:H/PR:L) crashes the host-side bhyve process or potentially yields arbitrary code execution in the host userspace running the VM, bounded by bhyve's Capsicum sandbox. Exploitation requires an attacker who already controls privileged code inside a guest configured with the bhyve xHCI controller; no public exploit code was identified at time of analysis, and EPSS is low at 0.18% (7th percentile), making this a moderate, defense-in-depth priority rather than an urgent emergency.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Local privilege escalation in Windows BITS allows an authenticated attacker with low-level privileges to exploit a race condition and elevate to higher integrity on affected Windows 10, 11, and Server systems. Exploitation requires a pre-existing local foothold and winning a narrow timing window, making success probabilistic; no public exploit has been identified. Microsoft has released patches for all supported versions.
Privilege escalation on supported Windows 10, Windows 11, and Windows Server builds stems from a use-after-free in the Cloud Files Mini Filter Driver (cldflt.sys), the component that services OneDrive-style cloud placeholder files. An attacker who already holds local, authenticated access to the host (CVSS PR:L, AC:H) and can drive concurrent cloud-file operations may win a narrow race window (CWE-362) and corrupt driver memory, ultimately gaining SYSTEM-level code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is not confirmed actively exploited (CISA KEV) and no public exploit code was identified at time of analysis; the local foothold requirement, the timing-dependent nature of the race, and the need for repeated attempts keep realistic risk below the raw score. Vendor patches are available from Microsoft.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Local privilege escalation in Windows Installer (CVSS 7.0) lets an attacker who already holds low-privilege, local access on a Windows host escalate to SYSTEM by winning a race condition in the service's handling of a shared resource during concurrent execution. The flaw is CWE-362 and carries AC:H in the assessed vector, so the timing window is narrow and exploitation may require repeated attempts; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has published fixed builds for the affected Windows 10, Windows 11 and Windows Server releases via the MSRC update guide for CVE-2026-85941, making prompt patching the definitive mitigation.
Local privilege escalation in the Windows Clipboard User Service allows an attacker who already holds a low-privileged, authenticated session on a Windows host to win a race condition on an improperly synchronized shared resource and elevate their privileges on that machine. Only local access is viable (AV:L, PR:L) with no user interaction required, and the timing-dependent nature of the flaw (AC:H, SSVC Automatable=no) means exploitation is non-deterministic and typically requires many repeated attempts rather than a reliable one-shot trigger. There is confirmed publicly documented vendor patching but no public exploit identified at time of analysis, and the race-condition reliability plus the prerequisite foothold make practical risk more moderate than the 7.0 severity score alone suggests.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
Local privilege escalation in the Windows Phone Service on Windows 11 (23H2 through 26H2) and Windows Server 2022 lets an authenticated, low-privileged user on the machine win a race condition in a shared resource and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable and requires a pre-existing local account, and the AC:H rating reflects that a narrow, non-deterministic synchronization window must be won reliably - typically over many repeated attempts - so this is a patch-cycle item rather than an emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no). Vendor patches are available per the MSRC advisory.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
Local privilege escalation in Windows Active Directory Certificate Services (AD CS) arises from a race condition (CWE-362) on a shared resource, letting an attacker who already holds a low-privileged, locally authenticated account on an AD CS host gain elevated privileges with high impact to confidentiality, integrity, and availability. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable and requires no victim interaction, but its high attack complexity means success depends on winning a narrow, timing-dependent race, so exploitation is non-deterministic and may need many attempts rather than being cleanly automatable - consistent with CISA's SSVC rating of exploitation 'none' and automatable 'no'. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Microsoft has shipped a vendor update, making patching the definitive fix.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
Use-after-free in the Windows DHCP Client service lets an unauthenticated attacker who is positioned on the same adjacent network segment (the same broadcast domain, for example via a rogue DHCP server) run code in the context of the DHCP client, with the affected platforms being Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 including their Server Core installations. Reaching the freed object requires triggering and winning a race condition (CWE-362) in the client's handling of DHCP traffic, so exploit reliability is timing-dependent; our independent assessment therefore scores this CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, treating attack complexity as High rather than the vendor-published Low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing confirming active exploitation, and no EPSS data was supplied with the source material.
Privilege escalation and security-feature bypass in Microsoft ASP.NET Core's Blazor authorization stack lets an authenticated remote user defeat an application's [Authorize] decision and reach content or operations their role should not permit. The flaw is a race condition in the Microsoft.AspNetCore.Components.Authorization AuthorizeRouteView component, where a stale asynchronous authorization result can be applied after a navigation or an authorization-state change, so the current authorization decision is silently overwritten by an earlier one. Only Blazor applications that use AuthorizeRouteView for route-level authorization are in scope; ASP.NET Core deployments that do not use Blazor component-level authorization are unaffected. Exploitation is non-deterministic (CVSS AC:H) and requires the attacker to already hold a valid authenticated session (PR:L), and publicly available exploit code exists as a published proof-of-concept gist, but CISA SSVC rates exploitation as none and the issue is not automatable. Vendor patches are available across all supported ASP.NET Core release trains.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Unauthenticated remote code execution in the Microsoft Windows DHCP Server role is achievable when an attacker on a reachable network segment wins a race condition on a shared resource inside the DHCP service. The vulnerability is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with complete confidentiality, integrity and availability impact, but the high attack complexity reflects a narrow, non-deterministic synchronization window that makes exploitation unreliable and typically requires repeated concurrent DHCP requests, potentially combined with favorable server load conditions. No public exploit code was identified at time of analysis and there is no CISA KEV listing; hosts without the DHCP Server role installed, or where DHCP traffic cannot be reached from an untrusted segment, are not exposed.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege escalation in Windows Credential Manager affects Windows 10, Windows 11, and Windows Server (2012 through 2025) builds, letting an attacker who already holds a low-privileged local session on the host win a race condition (CWE-362) and elevate to higher privileges. The vulnerable component is not remotely reachable and the high attack complexity rating reflects a non-deterministic timing window that may require repeated attempts; exploitation requires authenticated local access (CVSS vector PR:L/AV:L), and no public exploit identified at time of analysis, with CISA SSVC recording no observed exploitation. Microsoft has published updated builds that correct the synchronization flaw, so remediation is a matter of patching rather than emergency mitigation.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Unauthenticated remote attackers can obtain another client's PHP session identifier from FrankenPHP worker mode before 1.12.5 when the session extension is loaded as a shared module rather than statically compiled in. Because frankenphp_reset_session_state() is compiled out under that build configuration, PS(id) persists across request boundaries on the same worker thread, so a later session_start() may keep a stale identifier instead of adopting the new request's cookie, and under concurrent requests session_id() can return a different user's identifier - enabling information disclosure, session hijacking, and intermittent logouts, with integrity and availability also impacted (CVSS 7.7, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, CWE-362). Exposure is conditional: official static binaries and Docker images that link the session extension statically are not affected, non-worker (classic) mode is not implicated, and the leak is intermittent and timing-dependent; no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Sandbox escape in Mozilla Firefox allows attacker-controlled web content to break out of the browser's content sandbox by winning a timing-dependent race condition in the Networking component (CWE-362), rated CVSS 8.3 with scope change (S:C), meaning compromise extends beyond the sandboxed process. Exploitation is unauthenticated (PR:N) and remote (AV:N) but requires the victim to load attacker-controlled web content (UI:R) and is unreliable per attempt due to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.16% (5th percentile); the vulnerability is fixed in Firefox 158 and Firefox ESR 153.5.
Trust bypass in Apache CXF's STSTokenValidator allows a remote, unauthenticated attacker to have a forged SAML assertion signed with an untrusted certificate accepted as trusted without the assertion ever being validated by the Security Token Service. Only deployments that use STSTokenValidator to validate SAML tokens while leaving alwaysValidateToSts unset are affected, and exploitation additionally requires a race window in which the result of a concurrent legitimate request's successful trust check is read from shared state. No public exploit code or CISA KEV listing has been identified at time of analysis, EPSS is 0.17% (6th percentile), and vendor fixes are available in Apache CXF 4.2.4, 4.1.9 and 3.6.13.
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Local privilege escalation to root in the IBM Guardium Data Protection 12.2 patch installer, where a signature-verification bypass lets an attacker substitute a tampered or unsigned patch artifact that the installer then executes with root privileges. Exploitation requires local access to the appliance with at least low-level privileges (PR:L) and the ability to stage a malicious patch and win a timing window during installation; the assessed vector is AV:L/AC:H with a resulting base score of roughly 7.0, slightly below the vendor-published 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a patch; this is a credible but not emergency-tier priority given the local-only attack path, prerequisite foothold, and race-condition reliability constraints.
Race condition in the V8 JavaScript engine allows remote code execution inside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. A remote, unauthenticated attacker can trigger the flaw by getting a victim to open attacker-supplied HTML that drives V8 into the timing window (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - the required user interaction is the only precondition, and code execution is confined to the renderer/V8 sandbox, so host compromise would require a second, separate sandbox-escape bug. Google has shipped a fixed stable-channel build, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC records Exploitation: none; no KEV listing or PoC in the available sources).
A sandbox escape in Google Chrome before 155.0.8059.39 lets an attacker who has already compromised the browser's renderer process trigger a race condition in Chrome's font handling and execute arbitrary code outside the sandbox, via a crafted HTML page the victim must load (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3). The prerequisite is significant: a separate, prior renderer compromise is required, and AC:H reflects the non-deterministic nature of winning the race, so this is a chained post-exploitation primitive rather than a standalone drive-by. Unauthenticated from a network perspective, with UI:R meaning the target must open attacker-controlled content; no CISA KEV entry, no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once the race is won. Vendor-released patch: 155.0.8059.39.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39 through a race condition in the V8 JavaScript engine, triggered when a victim loads a crafted HTML page. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) and depends on winning a non-deterministic timing window, which is reflected in the assessed AC:H and makes reliable exploitation harder. Resulting code execution stays within the renderer sandbox, so escaping to the host OS would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis, and vendor patches are available.
Sandbox escape in Google Chrome versions prior to 155.0.8059.39: a race condition (CWE-362) in the browser's font handling can be triggered when a victim renders a crafted HTML page, potentially allowing a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the target to load or view the attacker-controlled page (UI:R) and depends on winning a timing-sensitive race (AC:H), which typically demands repeated attempts and precise memory grooming, making this a credible high-priority browser flaw rather than a confirmed emergency. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available from Google.
A race condition in Google Chrome's Fonts component prior to version 155.0.8059.39 lets a remote attacker escape the browser sandbox and execute arbitrary code at the browser's privilege level, but only after the attacker has already compromised a sandboxed renderer process through some separate, unrelated vulnerability. The exploit additionally requires the victim to load a crafted HTML page (UI:R) and the attacker to win a timing-dependent race (AC:H), so this is best understood as a sandbox-escape primitive rather than a standalone initial-access vector. There is no public exploit identified at time of analysis - CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable - and a vendor-released patch (155.0.8059.39) is available, making this a high-priority defense-in-depth fix rather than a catastrophic unpatched bug.
A use-after-free race condition in the Android kernel's epoll teardown path (ep_free in eventpoll.c) lets a locally installed or otherwise compromised unprivileged app escalate to kernel-level privileges by reclaiming a freed eventpoll object before cleanup completes. The flaw is tracked as CVE-2026-56906 (CWE-362) with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires an existing low-privilege code-execution foothold and a successful, timing-sensitive race - no user interaction and no special product configuration are needed. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV absent; SSVC Exploitation='none', Automatable='no'), which places this in the second-tier priority band for most defenders.
Local privilege escalation in ClamXAV versions 3.3 through 3.11 allows an attacker who already holds a low-privileged local account on a macOS host to execute arbitrary code with system privileges by winning a race condition in the bundled Privileged Helper Tool that combines with insufficient file validation. Exploitation is timing-dependent (AV:L/AC:H/PR:L/UI:N in the assessed vector, with high confidentiality, integrity, and availability impact) and typically requires repeated attempts rather than a single deterministic trigger, making this a credible but not emergency-tier priority; no public exploit code has been identified at time of analysis, and ClamXAV 3.11.1 fully remediates the flaw.
Code execution via local privilege escalation is possible in Google Android's Bluetooth AVRCP handling (handle_app_val_response in btif_rc.cc) because of a race condition (CWE-362) that can corrupt shared state in the Bluetooth stack. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects Android 16, Android 16-qpr2, and Android 17; an attacker must already have a low-privilege app installed on the device and must repeatedly drive the AVRCP remote-control code path to win a narrow timing window, with no user interaction required. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so while the technical impact is total if the race is won, the high attack complexity and local-only prerequisites keep this a lower-urgency item than a remotely reachable, deterministic bug.
A race condition in Apache Struts' application-wide localization (i18n) text provider lets a message formatter that has been cached for one request be reused by concurrently served requests, so a date or time value belonging to one user can surface in another user's rendered response, or the formatting can fail and appear as a server error. The flaw affects Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0; applications whose localized messages format no date or time arguments are explicitly not affected, which is the exact gating condition for exposure. No public exploit code or confirmed active exploitation has been identified, EPSS is low at 0.18% (7th percentile), and the outcome is timing-dependent and non-deterministic - leaking only values passed as date/time format arguments, not arbitrary memory - which is why our assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) is materially more conservative than the vendor's 8.8 score.
Plane's InstanceAdminSignUpEndpoint in versions 0.13 through pre-1.4.0 allows unauthenticated remote attackers to exploit a time-of-check time-of-use race during first-run setup and create a second instance administrator with full instance-admin authority alongside the legitimate operator. Exploitation requires that no instance administrator exists yet and that the attacker wins a concurrent-request race before the legitimate first admin is committed; after setup completes, the endpoint rejects new admins and the flaw is unreachable. No public exploit identified at time of analysis, and the risk is situational because the vulnerable window is brief and requires network reachability to the admin signup path.
Unauthenticated denial-of-service in Podgrab's WebSocket handler allows remote attackers to crash the process by exploiting a race condition in the activePlayers and allConnections maps, requiring manual operator restart to restore service. Affecting all versions per the CPE wildcard, the flaw is exploitable by anyone who can reach the /ws endpoint, with no authentication or user interaction needed. No public exploit code has been identified, but the low-complexity network vector and availability-only impact make it a plausible risk for internet-exposed instances, though Podgrab's limited footprint tempers its overall priority.
Second-factor authentication bypass in MISP versions before 2.5.48 lets an attacker who already holds a session past the password step and a copy of the HOTP paper-token list replay a previously consumed HOTP token, because the OTP check compared the submitted token against a counter cached in the user's session rather than the authoritative database counter; the stale cached value still matches the burned token, yielding a second successful login and rewinding the counter state. Exploitation is not anonymous: it requires an authenticated session (PR:L per the assessed vector, implying prior password compromise), HOTP paper-token 2FA explicitly enabled on the target account, and knowledge of at least one valid token value, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (vendor CVSS 4.0 score 7.6, High). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in MISP 2.5.48 by commit f34aee2c7.
Concurrent monitoring requests against CODESYS control runtimes are not synchronized, letting an authenticated remote client that already holds monitoring rights corrupt internal memory structures and produce incorrect data processing or a denial-of-service condition. Affected components span the CODESYS soft-PLC family - Control RTE (SL) and Control RTE (for Beckhoff CX) SL, Control Win (SL), Runtime Toolkit, Safety SIL2, HMI (SL), Development System 3, and the Control for Linux, Linux ARM, Raspberry Pi, BeagleBone, PFC100, PFC200, PLCnext, IOT2000, emPC-A/iMX6, WAGO Touch Panels 600 and Virtual Control SL variants. Network reachable with only low privileges (PR:L), no user interaction and no non-default configuration, the race yields high integrity and availability impact but no confidentiality exposure (CVSS 4.0 base 7.2; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no publicly available exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
A race condition in Mozilla Firefox's Audio/Video component can culminate in a use-after-free, potentially allowing memory corruption when a victim loads attacker-controlled media content in any Firefox build prior to version 157. Exploitation is unauthenticated over the network but demands both user interaction (the victim must visit or interact with a crafted page) and a precisely won, non-deterministic timing window between concurrent media-processing operations, which makes the bug high-complexity and not automatable (SSVC Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Firefox 157 as the fix per advisory mfsa2026-97.
A race condition in the Linux kernel cgroup task iterator (css_task_iter_next) can hand back a task_struct whose reference count has already dropped to zero, resulting in a use-after-free that a local attacker can turn into kernel memory corruption. Only systems running affected kernels built with cgroups are exposed, and the attacker must be able to read a cgroup.procs file while concurrently spawning and tearing down multi-threaded process groups - a low-privileged but purely local position (CVSS:3.1/AV:L/AC:H/PR:L). Exploitation is gated by an extremely narrow timing window tied to RCU grace periods and task teardown ordering, so the flaw is high-severity on paper but difficult to trigger reliably; EPSS is only 0.18% (7th percentile) and no public exploit code was identified at time of analysis.
A use-after-free race condition in the Linux kernel's ksmbd in-kernel SMB3 server can crash the kernel (denial of service) when a session is torn down while multiple channels are bound to a session and deferred byte-range locks or pending CANCELs remain counted as running requests. Affected systems must have ksmbd enabled (CONFIG_SMB_SERVER) and exporting at least one SMB3 share, and an authenticated remote attacker (PR:L) must negotiate SMB3 multichannel to race a LOGOFF, synchronous CANCEL, or abrupt connection teardown against still-running requests; success is non-deterministic (AC:H). No public exploit code has been identified at time of analysis, and the impact is availability loss, not information disclosure or confidentiality/integrity compromise as some tags or the base CVSS may imply.
A concurrency flaw in the Linux kernel's mlxsw Spectrum PTP driver (spectrum_ptp) can panic the kernel when a stale PTP entry is reaped by the garbage-collection workqueue at the same moment the threaded NAPI poll is running on another CPU. The GC path calls mlxsw_sp1_ptp_unmatched_finish() → mlxsw_sp1_ptp_packet_finish() → mlxsw_sp_rx_listener_no_mark_func(), which ends in napi_gro_receive() using a NAPI pointer captured earlier in the RX context; because mlxsw_pci_napi_devs_init() unconditionally calls netif_threaded_enable(), that poll runs as an independently scheduled kthread that local_bh_disable() on the GC CPU cannot protect against, so both CPUs mutate the same GRO list and hit list_add corruption / 'kernel BUG at lib/list_debug.c'. Exploitation is not remotely trivial: it requires physical Mellanox Spectrum hardware running the mlxsw driver, PTP hardware timestamping configured and active (e.g. ptp4l) with privileged CAP_NET_ADMIN access, plus a genuine timing race (AC:H) - the reported trigger is a tx-timestamp timeout while a port transitions to UNCALIBRATED/SLAVE. No public exploit code or in-the-wild activity has been identified at time of analysis, and our independent assessment rates the published CVSS 7.5 (AV:A/PR:N) as an overstatement, scoring the issue as a locally triggered, privilege-gated denial-of-service/kernel-panic (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H).
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Google Chrome stable builds earlier than 154.0.8037.57 contain a race condition (CWE-362) that a remote attacker can trigger by getting a victim to load attacker-controlled web content, yielding high confidentiality, integrity, and availability impact within the browser's renderer sandbox. No authentication or special browser configuration is required (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), though user interaction - visiting or rendering hostile content - is the primary exploitation prerequisite, and a separate sandbox escape would be needed to reach the host. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV listing; the vendor has shipped a fixed release.
Concurrent upload-session requests in Cloudreve prior to 4.18.0 allow an authenticated user holding Files.Write permission - which the default User group provides - to bypass the per-account storage quota and reserve more space than the account is allowed, ultimately exhausting host disk and denying uploads to other users. The flaw is a time-of-check-to-time-of-use race: PrepareUpload validates capacity against a stale in-memory value while the actual storage charge is applied later and outside the same quota-enforcing transaction, so parallel requests that read the same snapshot all pass the MaxStorage check. Exploitation requires genuinely simultaneous requests and a valid low-privileged account, and impact is limited to availability (no data disclosure or code execution); no public exploit code was identified at time of analysis, and the issue is fixed in 4.18.0.
Unauthenticated administrator account creation in nginx-ignition affects deployments running versions prior to 2.41.1 that are still in their pre-onboarding state. The endpoint POST /api/users/onboarding/finish is registered as anonymous and, because its "onboarding already completed?" check is not atomic with the subsequent user write, a remote unauthenticated attacker (CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N, base 8.1) who can reach such an instance can create a full ReadWrite administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. No public exploit identified at time of analysis, and the practical window is narrow: exploitation requires the instance to be network-reachable while deployed but before a legitimate operator has completed onboarding - once onboarding is legitimately finished, the path is guarded.
An out-of-bounds write reachable through a race condition in google_mba_recv_msg() in google_mba_poll.c allows a locally installed low-privilege application on an affected Android device to corrupt kernel memory and escalate to system/kernel privileges. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N), the flaw requires no user interaction but does need the attacker to already run code on the device and to win a timing window, which keeps it materially below a remote, unauthenticated severity. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; no EPSS score was supplied in the source data.
Memory corruption in the ARM64 TLB-invalidation path of the Android kernel allows a local attacker holding low privileges to win a race condition and escalate to kernel/root privileges, with no user interaction and no additional execution privileges required. Affected builds are Google Android (CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), specifically ARM64 devices; Google's September 2026 Pixel security bulletin is the vendor reference for the fix. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed and no public exploit code has been identified at time of analysis.
Let me build the JSON. CVE-2026-58724: Android kernel use-after-free due to race condition, local EoP requiring System execution privileges, no UI. CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Reported by Google Devices. CPE: google:android. Tags: Privilege Escalation, Google, Race Condition. Reference: Android security bulletin September 2026 Pixel. Note: "System execution privileges needed" — this is Android bulletin phrasing meaning the attacker needs System-level privileges already... Actually in Android bulletins, "System execution privileges needed" means the vulnerability requires the attacker to already have System privileges? Hmm, actually Android bulletin says "This could lead to local escalation of privilege with System execution privileges needed" — meaning the attacker needs System execution privileges? Historically it means exploitation requires the attacker to run code with System privileges already... Actually it means the vulnerability can lead to local escalation of privilege with System execution privileges needed — i.e., it requires System-level privileges to exploit. That means privilege escalation from System to... hmm, in Android, "System" is a UID (system uid 1000). So it escalates to kernel. Actually "with System execution privileges needed" means the attacker must already have System privileges. CVSS PR:L is consistent-ish. Actually PR:L. Hmm but if System privileges needed, PR:H might be more apt. Given CVSS says PR:L, I'll assess PR:L... Hmm. My own assessment: AV:L/AC:H/PR:H? Let me think. The Android phrasing "System execution privileges needed" — needed to exploit — implies significant privileges already (system UID, not just any app). That's PR:H arguably. But CVSS gives PR:L. I'll go with PR:H? Let's be careful — I should ground my assessment in the description. The description says "with System execution privileges needed" — this means the exploit requires system-level privileges. So PR:H is honest. But the vendor's own CVSS says
A race condition in the trusty_dputc() debug output path of generic-arm64-smcall.c in the Android kernel allows an out-of-bounds write that can be leveraged for local privilege escalation. The flaw is only reachable by a process already running with System execution privileges, and exploitation requires winning a timing window (AC:H, PR:L), with no user interaction. Impact is high across confidentiality, integrity and availability because the corrupted memory is kernel/secure-monitor adjacent, but no public exploit code or in-the-wild exploitation is known from the available intelligence.
A use-after-free race condition in multiple locations of the Android kernel allows an attacker to corrupt kernel memory and escalate to remote code execution, affecting Android devices covered by the September 2026 Android Security Bulletin. Exploitation requires an attacker to already hold a low-privilege foothold on the device (CVSS PR:L) — typically a malicious or compromised application — and no user interaction is needed once that foothold exists. No public exploit code or CISA KEV listing was identified at time of analysis, so this is currently a patch-now kernel hardening issue rather than a confirmed in-the-wild campaign.
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
A race condition in Mozilla Firefox's XPConnect component allows an attacker who has already compromised execution inside the content/renderer sandbox to escape that boundary and reach higher-privileged browser code. Only Firefox builds prior to version 156 are affected; the flaw was fixed upstream and published in Mozilla's MFSA 2026-90/MFSA 2026-94 advisories. Exploitation is not a standalone remote code-execution path but a chained, timing-dependent step requiring a separate renderer compromise first, and no public exploit has been identified at time of analysis, with an EPSS score of just 0.14% (4th percentile) indicating low predicted real-world activity.
A race condition in Firefox's DOM: Content Processes component (CWE-362) lets attacker-controlled web content win a non-deterministic timing window and corrupt state inside the browser's content process, yielding high confidentiality and integrity impact; Mozilla fixed it in Firefox 156 and Firefox ESR 153.3. Reachable from any loaded page but gated by user interaction and a hard-to-reliably-win race (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5), the bug carries low exploitation likelihood signals (EPSS 0.15%, 5th percentile), is not on CISA KEV, and no public exploit code has been identified at time of analysis. All Firefox builds prior to the fixed releases match the affected CPE wildcard, so unpatched installations remain exposed to remote attackers who can persuade a user to open a crafted page.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
Local kernel memory corruption in Apple iOS and iPadOS (with parallel fixes in macOS, tvOS, visionOS and watchOS) lets an app already running on the device win a kernel race condition and either force an unexpected system termination or corrupt kernel memory, which can be leveraged toward full kernel read/write. Affected builds are iOS/iPadOS before 26.7 and before 27, macOS before 15.8, 26.7 (Tahoe) and 27 (Golden Gate), plus tvOS, visionOS and watchOS before 27; Apple has shipped fixes in every one of those branches. No public exploit code has been identified at time of analysis and EPSS is low at 0.18% (8th percentile), and because exploitation needs the attacker to already execute code as an app plus a timing-dependent race win, the vendor's own AV:L/PR:L vector (7.8 High) makes opportunistic mass exploitation impractical.
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Inventory integrity corruption in Snipe-IT ≤8.6.3 allows authenticated users holding consumable-checkout permission to over-allocate stock by exploiting a TOCTOU race condition in the API checkout endpoint. Concurrent POST requests to /api/v1/consumables/{consumable_id}/checkout each pass the pre-transaction availability check before either commits, enabling both to write checkout records and drive remaining inventory negative (e.g., a unit with 1 remaining ends at -1). Fixed in 8.7.0 via database row locking inside the transaction; no confirmed active exploitation at time of analysis, though proof-of-concept feasibility is noted by SSVC.
Remote unauthenticated retrieval of expired one-time secrets in PasswordPusher before 2.11.1 is enabled by a TOCTOU race condition in the expire_after_views view-limit enforcement logic. By issuing multiple simultaneous HTTP requests to the show endpoint, an attacker can read a secret that was configured to self-destruct after a single view, defeating the core confidentiality guarantee the tool is designed to provide. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, though the technique requires only basic HTTP concurrency tooling.
Race-condition-triggered code execution in Google Chrome's V8 JavaScript engine (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to execute arbitrary code inside the Chrome renderer sandbox by serving a crafted HTML page to a victim. Exploitation is constrained to the Chrome sandbox process rather than the underlying OS, which aligns with Chromium's own internal severity rating of 'Low' despite the CVSS base score of 7.5. No public exploit code or CISA KEV listing is present at time of analysis; the high attack complexity metric reflects the timing-sensitive nature of race-condition exploitation.
Sandbox-escape code execution via a race condition in the Google Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox. Affected builds are all Chrome versions prior to 153.0.8010.36 on Windows. The Chrome Updater's elevated-privilege execution context makes winning the race condition particularly impactful, as successful exploitation bypasses sandbox containment entirely.
Local privilege escalation in the Android common kernel's alloc.c memory allocation functions allows a low-privileged local user to gain full read/write access to kernel memory via a race condition. Multiple functions in alloc.c are affected, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the device. The vulnerability requires no user interaction and no elevated privileges beyond an existing local shell; Google addressed it in the September 2026 Android Security Bulletin with a patch committed to the Android common kernel repository.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
FreeBSD's bhyve hypervisor contains a guest-to-host race condition and input-validation flaw in its framebuffer/VNC device model, allowing a guest with existing code execution to crash the bhyve process or potentially execute code in the host userspace context, subject to bhyve's Capsicum sandbox. Only VMs configured with the fbuf framebuffer/VNC device are exposed, affecting FreeBSD 14.4 before p11, 14.5 before p2, and 15.1 before p5, while headless or serial-only guests are not affected by this path. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring guest-level privilege and a difficult timing race, and no public exploit identified at time of analysis.
FreeBSD's bhyve hypervisor xHCI (USB 3) device model can be driven into a guest-to-host memory race by a malicious privileged guest: the emulated controller neither validates nor caches the guest-supplied event ring size, re-reading it from guest memory on each use, and loads Transfer Request Block (TRB) fields without guarding against concurrent modification by the guest. Winning that race (CVSS 3.1 AV:L/AC:H/PR:L) crashes the host-side bhyve process or potentially yields arbitrary code execution in the host userspace running the VM, bounded by bhyve's Capsicum sandbox. Exploitation requires an attacker who already controls privileged code inside a guest configured with the bhyve xHCI controller; no public exploit code was identified at time of analysis, and EPSS is low at 0.18% (7th percentile), making this a moderate, defense-in-depth priority rather than an urgent emergency.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvruserservice) allows an authenticated user who already holds low privileges and local access to the host to elevate to a higher integrity context on affected Windows 10, Windows 11, and Windows Server 2019 installations. Success depends on winning a narrow, non-deterministic race window between the freeing and reuse of an object (CWE-362, reflected in the CVSS vector as AC:H), so exploitation is unreliable and may require many repeated attempts, though a successful trigger yields high confidentiality, integrity, and availability impact on the vulnerable component. No public exploit code was identified and there is no confirmed active exploitation (the vulnerability is not in CISA KEV); Microsoft has released fixed builds through its monthly update channel.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
Local privilege escalation in the Microsoft Windows Search Component lets an attacker who already holds low-privileged credentials on the host race an improperly synchronized shared resource to elevate into a higher-integrity context, gaining read and write access to protected data and the ability to impair system integrity. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - the attacker must reliably win a narrow timing window through repeated attempts - and no remote or unauthenticated path exists because the Search component is present by default in all supported Windows editions. There is no public exploit code and no confirmed active exploitation (no public exploit identified at time of analysis), and Microsoft has released a fix, so this is best treated as a credible but not top-tier patching priority.
Local privilege escalation in Windows BITS allows an authenticated attacker with low-level privileges to exploit a race condition and elevate to higher integrity on affected Windows 10, 11, and Server systems. Exploitation requires a pre-existing local foothold and winning a narrow timing window, making success probabilistic; no public exploit has been identified. Microsoft has released patches for all supported versions.
Privilege escalation on supported Windows 10, Windows 11, and Windows Server builds stems from a use-after-free in the Cloud Files Mini Filter Driver (cldflt.sys), the component that services OneDrive-style cloud placeholder files. An attacker who already holds local, authenticated access to the host (CVSS PR:L, AC:H) and can drive concurrent cloud-file operations may win a narrow race window (CWE-362) and corrupt driver memory, ultimately gaining SYSTEM-level code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is not confirmed actively exploited (CISA KEV) and no public exploit code was identified at time of analysis; the local foothold requirement, the timing-dependent nature of the race, and the need for repeated attempts keep realistic risk below the raw score. Vendor patches are available from Microsoft.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Local privilege escalation in Windows Installer (CVSS 7.0) lets an attacker who already holds low-privilege, local access on a Windows host escalate to SYSTEM by winning a race condition in the service's handling of a shared resource during concurrent execution. The flaw is CWE-362 and carries AC:H in the assessed vector, so the timing window is narrow and exploitation may require repeated attempts; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has published fixed builds for the affected Windows 10, Windows 11 and Windows Server releases via the MSRC update guide for CVE-2026-85941, making prompt patching the definitive mitigation.
Local privilege escalation in the Windows Clipboard User Service allows an attacker who already holds a low-privileged, authenticated session on a Windows host to win a race condition on an improperly synchronized shared resource and elevate their privileges on that machine. Only local access is viable (AV:L, PR:L) with no user interaction required, and the timing-dependent nature of the flaw (AC:H, SSVC Automatable=no) means exploitation is non-deterministic and typically requires many repeated attempts rather than a reliable one-shot trigger. There is confirmed publicly documented vendor patching but no public exploit identified at time of analysis, and the race-condition reliability plus the prerequisite foothold make practical risk more moderate than the 7.0 severity score alone suggests.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Composite Image File System (CimFS) driver allows an authenticated, low-privileged local user to reach SYSTEM-level code execution by winning a timing race that triggers a use-after-free in the driver. Exploitation requires an existing local account plus the ability to run code on the host, and the high attack complexity (AC:H) of the race makes success probabilistic rather than reliable, with no user interaction needed; no public exploit identified at time of analysis, and there is no KEV listing. Affected builds include Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2022/2025 below their fixed build numbers, and Microsoft has released patches.
Local privilege escalation in the Windows Phone Service on Windows 11 (23H2 through 26H2) and Windows Server 2022 lets an authenticated, low-privileged user on the machine win a race condition in a shared resource and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remotely reachable and requires a pre-existing local account, and the AC:H rating reflects that a narrow, non-deterministic synchronization window must be won reliably - typically over many repeated attempts - so this is a patch-cycle item rather than an emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation none, Automatable no). Vendor patches are available per the MSRC advisory.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
Local privilege escalation in the Windows Overlay Filter (WOF) driver allows an authenticated attacker with low-privileged local access to gain elevated privileges on affected Windows systems. The flaw is a race condition (CWE-362) that is timing-sensitive (CVSS AC:H) and requires no user interaction (UI:N), making exploitation probabilistic and limited to local contexts. No public exploit code was identified at time of analysis, and no active exploitation is confirmed (CISA SSVC: Exploitation=none); vendor patches are available.
Local privilege escalation in the Microsoft Bluetooth Driver allows an authorized, low-privileged user already running code on a Windows host to win a timing-dependent race condition and elevate to full system privileges (high confidentiality, integrity and availability impact). Exploitation is strongly limited by high attack complexity: the race window is non-deterministic, success is unreliable, and the flaw is not automatable, so it cannot be exploited by network-only attackers. There is no public exploit identified at time of analysis - CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - and no KEV listing exists, making this a moderate-priority local EoP issue rather than an emergency. Vendor patches are available through Microsoft's update guide.
A usable race condition in the Windows Win32K kernel-mode driver allows an authenticated attacker who already holds low-privileged local code execution on a host to escalate to SYSTEM-level rights. Because the flaw requires both an existing local foothold and repeated attempts to reliably win a narrow timing window, it functions as a post-compromise or malicious-insider escalation primitive rather than a remotely reachable attack - there is no network vector (AV:L), no user interaction (UI:N), and no public exploit identified at time of analysis. Microsoft has released fixes covering Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025, and CISA's SSVC assessment records no exploitation activity, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Local privilege escalation in Microsoft Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an authenticated, low-privileged attacker who already has local code execution to corrupt kernel memory and raise their privileges to kernel/SYSTEM level. The bug is a use-after-free reached by winning a race condition (CWE-362) in the socket-handling path, which is why it carries high attack complexity (AC:H) - exploitation requires repeatedly racing a narrow timing window and is unreliable and non-automatable (SSVC Automatable=no). Almost every supported Windows client and server build is affected because AFD.sys is loaded by default, but the practical exposure is limited to multi-user hosts or post-foothold escalation; vendor patches are available and no public exploit code or observed exploitation was identified at the time of analysis.
Local privilege escalation in the Microsoft Windows Local Security Authority Server (lsasrv) lets an attacker who already holds a low-privilege local account win a race condition and trigger a use-after-free, corrupt memory inside the LSA process and run code with SYSTEM-level privileges, yielding high confidentiality, integrity and availability impact (CVSS 7.0). Affected builds cover default installations of Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core editions, below the vendor's patched builds. No public exploit identified at time of analysis and CISA's SSVC records Exploitation=none with Automatable=no, meaning the high-complexity timing window (AC:H) makes dependable, repeatable exploitation unlikely without significant effort. The elevation is not remotely reachable: an authenticated local foothold on the host is a prerequisite.
Local privilege escalation in Windows Active Directory Certificate Services (AD CS) arises from a race condition (CWE-362) on a shared resource, letting an attacker who already holds a low-privileged, locally authenticated account on an AD CS host gain elevated privileges with high impact to confidentiality, integrity, and availability. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is not remotely reachable and requires no victim interaction, but its high attack complexity means success depends on winning a narrow, timing-dependent race, so exploitation is non-deterministic and may need many attempts rather than being cleanly automatable - consistent with CISA's SSVC rating of exploitation 'none' and automatable 'no'. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Microsoft has shipped a vendor update, making patching the definitive fix.
Local privilege escalation in Windows NTFS allows an authenticated local user to elevate privileges by winning a race condition on shared NTFS filesystem resources (CWE-362). Only systems running affected Windows builds below their fixed revision are vulnerable (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761), and exploitation requires the attacker to already have local code execution and to repeatedly contend for a narrow timing window, making it probabilistic and non-automatable per CISA SSVC. No public exploit has been identified at time of analysis, no KEV listing exists, and vendor patches are available.
Use-after-free in the Windows DHCP Client service lets an unauthenticated attacker who is positioned on the same adjacent network segment (the same broadcast domain, for example via a rogue DHCP server) run code in the context of the DHCP client, with the affected platforms being Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 including their Server Core installations. Reaching the freed object requires triggering and winning a race condition (CWE-362) in the client's handling of DHCP traffic, so exploit reliability is timing-dependent; our independent assessment therefore scores this CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, treating attack complexity as High rather than the vendor-published Low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing confirming active exploitation, and no EPSS data was supplied with the source material.
Privilege escalation and security-feature bypass in Microsoft ASP.NET Core's Blazor authorization stack lets an authenticated remote user defeat an application's [Authorize] decision and reach content or operations their role should not permit. The flaw is a race condition in the Microsoft.AspNetCore.Components.Authorization AuthorizeRouteView component, where a stale asynchronous authorization result can be applied after a navigation or an authorization-state change, so the current authorization decision is silently overwritten by an earlier one. Only Blazor applications that use AuthorizeRouteView for route-level authorization are in scope; ASP.NET Core deployments that do not use Blazor component-level authorization are unaffected. Exploitation is non-deterministic (CVSS AC:H) and requires the attacker to already hold a valid authenticated session (PR:L), and publicly available exploit code exists as a published proof-of-concept gist, but CISA SSVC rates exploitation as none and the issue is not automatable. Vendor patches are available across all supported ASP.NET Core release trains.
Local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc) affects a broad set of Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds, allowing an attacker who already holds an authenticated low-privileged local account to raise their privileges to a higher integrity level. The flaw is a race condition (CWE-362) in which concurrent access to an improperly synchronized shared resource can be timed to corrupt service state; the narrow, hard-to-control timing window is reflected in the high attack complexity (AC:H) of the assessed CVSS 7.0 (High) vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning remote or anonymous exploitation is not possible and success likely requires repeated attempts. Vendor patches are available and no public exploit code has been identified at time of analysis; the service ships by default on supported editions, so exposure is limited mainly by the requirement for pre-existing local access.
Local privilege escalation in the Windows Storage component allows an authenticated, low-privileged attacker to gain full control of a Windows host (C:H/I:H/A:H) by winning a race condition that triggers a use-after-free in the storage stack. Exploitation requires an existing local foothold (AV:L, PR:L) and is timing-dependent and non-deterministic (AC:H, CWE-362), so it is a post-compromise escalation primitive rather than a remotely reachable or mass-exploitable bug. This is a moderate-priority local elevation-of-privilege flaw, not an emergency: no public exploit code and no evidence of active exploitation were identified at time of analysis (SSVC Exploitation=none, Automatable=no), and Microsoft has released a vendor patch.
Local privilege escalation in the Windows Storage component lets an attacker who already holds a foothold on a Windows host with low-level privileges (PR:L) escalate to full system rights by winning a race condition (CWE-362) in the storage subsystem's handling of a shared resource. The attack is entirely local (AV:L), requires no user interaction, and is assessed at CVSS:3.1 base 7.0 with HIGH attack complexity because the timing window is narrow and non-deterministic, which is why CISA's SSVC rates it non-automatable with no observed exploitation; no public exploit code was identified at time of analysis. Because successful escalation grants high confidentiality, integrity and availability impact on the host, unpatched Windows 10, Windows 11 and Windows Server builds exposed to multi-user or post-compromise scenarios should be prioritized for the vendor patch.
Local privilege escalation in the Windows Storage component of Windows 10, Windows 11, and Windows Server 2019/2022/2025 allows an authenticated attacker with standard user rights to raise their privileges to SYSTEM level on the affected host. Exploitation requires an existing local foothold and winning a timing race in the storage stack (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so this is realistically a post-compromise escalation step rather than an initial-access or network-reachable flaw; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft rates the issue 7.0 High and vendor patches are available for all affected branches.
Unauthenticated remote code execution in the Microsoft Windows DHCP Server role is achievable when an attacker on a reachable network segment wins a race condition on a shared resource inside the DHCP service. The vulnerability is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with complete confidentiality, integrity and availability impact, but the high attack complexity reflects a narrow, non-deterministic synchronization window that makes exploitation unreliable and typically requires repeated concurrent DHCP requests, potentially combined with favorable server load conditions. No public exploit code was identified at time of analysis and there is no CISA KEV listing; hosts without the DHCP Server role installed, or where DHCP traffic cannot be reached from an untrusted segment, are not exposed.
Local privilege escalation in the Windows Storage component of supported Windows 10, Windows 11, and Windows Server releases lets a low-privileged attacker who already holds an account or process on the host race a use-after-free to reach a higher-integrity context, with high confidentiality, integrity, and availability impact. Exploitation is timing-dependent rather than deterministic: the attacker must win a race condition (CWE-362, reflected in the high attack complexity of the CVSS vector) and needs an existing local foothold (AV:L, PR:L, no user interaction required), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has shipped vendor patches for all listed builds, so this is a genuine but moderate-priority patch-cycle item rather than an urgent internet-facing threat; the residual risk is that local privilege-escalation fixes are commonly reverse-engineered into exploits after publication, which makes timely patching of multi-user and remote-access hosts worthwhile.
Use-after-free in the Windows Storage component allows an authenticated low-privileged local user to elevate privileges to full system integrity on affected Windows hosts. Exploitation requires winning a narrow race-condition timing window (CWE-362) and grooming freed memory for reuse, which is why attack complexity is rated high and CISA's SSVC assessment marks the flaw non-automatable, keeping this a moderate-priority rather than drop-everything issue. All currently supported Windows 10, Windows 11 and Windows Server builds below the vendor-fixed versions are affected, including Server Core installations, but Microsoft has released patches; no public exploit code has been identified and no exploitation activity is recorded (CISA SSVC exploitation: none).
Local privilege escalation in Windows Credential Manager affects Windows 10, Windows 11, and Windows Server (2012 through 2025) builds, letting an attacker who already holds a low-privileged local session on the host win a race condition (CWE-362) and elevate to higher privileges. The vulnerable component is not remotely reachable and the high attack complexity rating reflects a non-deterministic timing window that may require repeated attempts; exploitation requires authenticated local access (CVSS vector PR:L/AV:L), and no public exploit identified at time of analysis, with CISA SSVC recording no observed exploitation. Microsoft has published updated builds that correct the synchronization flaw, so remediation is a matter of patching rather than emergency mitigation.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker with low privileges to gain elevated rights by exploiting a race condition that leads to a use-after-free. Exploitation requires VBS with Enclaves to be enabled and a pre-existing local foothold, and the attacker must win a timing race (CWE-362). Microsoft rates this as CVSS 7.0 (High); no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
Unauthenticated remote attackers can obtain another client's PHP session identifier from FrankenPHP worker mode before 1.12.5 when the session extension is loaded as a shared module rather than statically compiled in. Because frankenphp_reset_session_state() is compiled out under that build configuration, PS(id) persists across request boundaries on the same worker thread, so a later session_start() may keep a stale identifier instead of adopting the new request's cookie, and under concurrent requests session_id() can return a different user's identifier - enabling information disclosure, session hijacking, and intermittent logouts, with integrity and availability also impacted (CVSS 7.7, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, CWE-362). Exposure is conditional: official static binaries and Docker images that link the session extension statically are not affected, non-worker (classic) mode is not implicated, and the leak is intermittent and timing-dependent; no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Sandbox escape in Mozilla Firefox allows attacker-controlled web content to break out of the browser's content sandbox by winning a timing-dependent race condition in the Networking component (CWE-362), rated CVSS 8.3 with scope change (S:C), meaning compromise extends beyond the sandboxed process. Exploitation is unauthenticated (PR:N) and remote (AV:N) but requires the victim to load attacker-controlled web content (UI:R) and is unreliable per attempt due to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.16% (5th percentile); the vulnerability is fixed in Firefox 158 and Firefox ESR 153.5.
Trust bypass in Apache CXF's STSTokenValidator allows a remote, unauthenticated attacker to have a forged SAML assertion signed with an untrusted certificate accepted as trusted without the assertion ever being validated by the Security Token Service. Only deployments that use STSTokenValidator to validate SAML tokens while leaving alwaysValidateToSts unset are affected, and exploitation additionally requires a race window in which the result of a concurrent legitimate request's successful trust check is read from shared state. No public exploit code or CISA KEV listing has been identified at time of analysis, EPSS is 0.17% (6th percentile), and vendor fixes are available in Apache CXF 4.2.4, 4.1.9 and 3.6.13.
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Local privilege escalation to root in the IBM Guardium Data Protection 12.2 patch installer, where a signature-verification bypass lets an attacker substitute a tampered or unsigned patch artifact that the installer then executes with root privileges. Exploitation requires local access to the appliance with at least low-level privileges (PR:L) and the ability to stage a malicious patch and win a timing window during installation; the assessed vector is AV:L/AC:H with a resulting base score of roughly 7.0, slightly below the vendor-published 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a patch; this is a credible but not emergency-tier priority given the local-only attack path, prerequisite foothold, and race-condition reliability constraints.
Race condition in the V8 JavaScript engine allows remote code execution inside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. A remote, unauthenticated attacker can trigger the flaw by getting a victim to open attacker-supplied HTML that drives V8 into the timing window (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - the required user interaction is the only precondition, and code execution is confined to the renderer/V8 sandbox, so host compromise would require a second, separate sandbox-escape bug. Google has shipped a fixed stable-channel build, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC records Exploitation: none; no KEV listing or PoC in the available sources).
A sandbox escape in Google Chrome before 155.0.8059.39 lets an attacker who has already compromised the browser's renderer process trigger a race condition in Chrome's font handling and execute arbitrary code outside the sandbox, via a crafted HTML page the victim must load (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3). The prerequisite is significant: a separate, prior renderer compromise is required, and AC:H reflects the non-deterministic nature of winning the race, so this is a chained post-exploitation primitive rather than a standalone drive-by. Unauthenticated from a network perspective, with UI:R meaning the target must open attacker-controlled content; no CISA KEV entry, no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no, though technical impact is total once the race is won. Vendor-released patch: 155.0.8059.39.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39 through a race condition in the V8 JavaScript engine, triggered when a victim loads a crafted HTML page. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) and depends on winning a non-deterministic timing window, which is reflected in the assessed AC:H and makes reliable exploitation harder. Resulting code execution stays within the renderer sandbox, so escaping to the host OS would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis, and vendor patches are available.
Sandbox escape in Google Chrome versions prior to 155.0.8059.39: a race condition (CWE-362) in the browser's font handling can be triggered when a victim renders a crafted HTML page, potentially allowing a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the target to load or view the attacker-controlled page (UI:R) and depends on winning a timing-sensitive race (AC:H), which typically demands repeated attempts and precise memory grooming, making this a credible high-priority browser flaw rather than a confirmed emergency. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available from Google.
A race condition in Google Chrome's Fonts component prior to version 155.0.8059.39 lets a remote attacker escape the browser sandbox and execute arbitrary code at the browser's privilege level, but only after the attacker has already compromised a sandboxed renderer process through some separate, unrelated vulnerability. The exploit additionally requires the victim to load a crafted HTML page (UI:R) and the attacker to win a timing-dependent race (AC:H), so this is best understood as a sandbox-escape primitive rather than a standalone initial-access vector. There is no public exploit identified at time of analysis - CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable - and a vendor-released patch (155.0.8059.39) is available, making this a high-priority defense-in-depth fix rather than a catastrophic unpatched bug.
A use-after-free race condition in the Android kernel's epoll teardown path (ep_free in eventpoll.c) lets a locally installed or otherwise compromised unprivileged app escalate to kernel-level privileges by reclaiming a freed eventpoll object before cleanup completes. The flaw is tracked as CVE-2026-56906 (CWE-362) with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires an existing low-privilege code-execution foothold and a successful, timing-sensitive race - no user interaction and no special product configuration are needed. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV absent; SSVC Exploitation='none', Automatable='no'), which places this in the second-tier priority band for most defenders.
Local privilege escalation in ClamXAV versions 3.3 through 3.11 allows an attacker who already holds a low-privileged local account on a macOS host to execute arbitrary code with system privileges by winning a race condition in the bundled Privileged Helper Tool that combines with insufficient file validation. Exploitation is timing-dependent (AV:L/AC:H/PR:L/UI:N in the assessed vector, with high confidentiality, integrity, and availability impact) and typically requires repeated attempts rather than a single deterministic trigger, making this a credible but not emergency-tier priority; no public exploit code has been identified at time of analysis, and ClamXAV 3.11.1 fully remediates the flaw.
Code execution via local privilege escalation is possible in Google Android's Bluetooth AVRCP handling (handle_app_val_response in btif_rc.cc) because of a race condition (CWE-362) that can corrupt shared state in the Bluetooth stack. The flaw is rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N) and affects Android 16, Android 16-qpr2, and Android 17; an attacker must already have a low-privilege app installed on the device and must repeatedly drive the AVRCP remote-control code path to win a narrow timing window, with no user interaction required. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so while the technical impact is total if the race is won, the high attack complexity and local-only prerequisites keep this a lower-urgency item than a remotely reachable, deterministic bug.
A race condition in Apache Struts' application-wide localization (i18n) text provider lets a message formatter that has been cached for one request be reused by concurrently served requests, so a date or time value belonging to one user can surface in another user's rendered response, or the formatting can fail and appear as a server error. The flaw affects Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0; applications whose localized messages format no date or time arguments are explicitly not affected, which is the exact gating condition for exposure. No public exploit code or confirmed active exploitation has been identified, EPSS is low at 0.18% (7th percentile), and the outcome is timing-dependent and non-deterministic - leaking only values passed as date/time format arguments, not arbitrary memory - which is why our assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) is materially more conservative than the vendor's 8.8 score.
Plane's InstanceAdminSignUpEndpoint in versions 0.13 through pre-1.4.0 allows unauthenticated remote attackers to exploit a time-of-check time-of-use race during first-run setup and create a second instance administrator with full instance-admin authority alongside the legitimate operator. Exploitation requires that no instance administrator exists yet and that the attacker wins a concurrent-request race before the legitimate first admin is committed; after setup completes, the endpoint rejects new admins and the flaw is unreachable. No public exploit identified at time of analysis, and the risk is situational because the vulnerable window is brief and requires network reachability to the admin signup path.
Unauthenticated denial-of-service in Podgrab's WebSocket handler allows remote attackers to crash the process by exploiting a race condition in the activePlayers and allConnections maps, requiring manual operator restart to restore service. Affecting all versions per the CPE wildcard, the flaw is exploitable by anyone who can reach the /ws endpoint, with no authentication or user interaction needed. No public exploit code has been identified, but the low-complexity network vector and availability-only impact make it a plausible risk for internet-exposed instances, though Podgrab's limited footprint tempers its overall priority.
Second-factor authentication bypass in MISP versions before 2.5.48 lets an attacker who already holds a session past the password step and a copy of the HOTP paper-token list replay a previously consumed HOTP token, because the OTP check compared the submitted token against a counter cached in the user's session rather than the authoritative database counter; the stale cached value still matches the burned token, yielding a second successful login and rewinding the counter state. Exploitation is not anonymous: it requires an authenticated session (PR:L per the assessed vector, implying prior password compromise), HOTP paper-token 2FA explicitly enabled on the target account, and knowledge of at least one valid token value, per the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (vendor CVSS 4.0 score 7.6, High). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in MISP 2.5.48 by commit f34aee2c7.
Concurrent monitoring requests against CODESYS control runtimes are not synchronized, letting an authenticated remote client that already holds monitoring rights corrupt internal memory structures and produce incorrect data processing or a denial-of-service condition. Affected components span the CODESYS soft-PLC family - Control RTE (SL) and Control RTE (for Beckhoff CX) SL, Control Win (SL), Runtime Toolkit, Safety SIL2, HMI (SL), Development System 3, and the Control for Linux, Linux ARM, Raspberry Pi, BeagleBone, PFC100, PFC200, PLCnext, IOT2000, emPC-A/iMX6, WAGO Touch Panels 600 and Virtual Control SL variants. Network reachable with only low privileges (PR:L), no user interaction and no non-default configuration, the race yields high integrity and availability impact but no confidentiality exposure (CVSS 4.0 base 7.2; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); no publicly available exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
A race condition in Mozilla Firefox's Audio/Video component can culminate in a use-after-free, potentially allowing memory corruption when a victim loads attacker-controlled media content in any Firefox build prior to version 157. Exploitation is unauthenticated over the network but demands both user interaction (the victim must visit or interact with a crafted page) and a precisely won, non-deterministic timing window between concurrent media-processing operations, which makes the bug high-complexity and not automatable (SSVC Automatable: no). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released Firefox 157 as the fix per advisory mfsa2026-97.
A race condition in the Linux kernel cgroup task iterator (css_task_iter_next) can hand back a task_struct whose reference count has already dropped to zero, resulting in a use-after-free that a local attacker can turn into kernel memory corruption. Only systems running affected kernels built with cgroups are exposed, and the attacker must be able to read a cgroup.procs file while concurrently spawning and tearing down multi-threaded process groups - a low-privileged but purely local position (CVSS:3.1/AV:L/AC:H/PR:L). Exploitation is gated by an extremely narrow timing window tied to RCU grace periods and task teardown ordering, so the flaw is high-severity on paper but difficult to trigger reliably; EPSS is only 0.18% (7th percentile) and no public exploit code was identified at time of analysis.
A use-after-free race condition in the Linux kernel's ksmbd in-kernel SMB3 server can crash the kernel (denial of service) when a session is torn down while multiple channels are bound to a session and deferred byte-range locks or pending CANCELs remain counted as running requests. Affected systems must have ksmbd enabled (CONFIG_SMB_SERVER) and exporting at least one SMB3 share, and an authenticated remote attacker (PR:L) must negotiate SMB3 multichannel to race a LOGOFF, synchronous CANCEL, or abrupt connection teardown against still-running requests; success is non-deterministic (AC:H). No public exploit code has been identified at time of analysis, and the impact is availability loss, not information disclosure or confidentiality/integrity compromise as some tags or the base CVSS may imply.
A concurrency flaw in the Linux kernel's mlxsw Spectrum PTP driver (spectrum_ptp) can panic the kernel when a stale PTP entry is reaped by the garbage-collection workqueue at the same moment the threaded NAPI poll is running on another CPU. The GC path calls mlxsw_sp1_ptp_unmatched_finish() → mlxsw_sp1_ptp_packet_finish() → mlxsw_sp_rx_listener_no_mark_func(), which ends in napi_gro_receive() using a NAPI pointer captured earlier in the RX context; because mlxsw_pci_napi_devs_init() unconditionally calls netif_threaded_enable(), that poll runs as an independently scheduled kthread that local_bh_disable() on the GC CPU cannot protect against, so both CPUs mutate the same GRO list and hit list_add corruption / 'kernel BUG at lib/list_debug.c'. Exploitation is not remotely trivial: it requires physical Mellanox Spectrum hardware running the mlxsw driver, PTP hardware timestamping configured and active (e.g. ptp4l) with privileged CAP_NET_ADMIN access, plus a genuine timing race (AC:H) - the reported trigger is a tx-timestamp timeout while a port transitions to UNCALIBRATED/SLAVE. No public exploit code or in-the-wild activity has been identified at time of analysis, and our independent assessment rates the published CVSS 7.5 (AV:A/PR:N) as an overstatement, scoring the issue as a locally triggered, privilege-gated denial-of-service/kernel-panic (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H).
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Google Chrome stable builds earlier than 154.0.8037.57 contain a race condition (CWE-362) that a remote attacker can trigger by getting a victim to load attacker-controlled web content, yielding high confidentiality, integrity, and availability impact within the browser's renderer sandbox. No authentication or special browser configuration is required (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), though user interaction - visiting or rendering hostile content - is the primary exploitation prerequisite, and a separate sandbox escape would be needed to reach the host. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV listing; the vendor has shipped a fixed release.
Concurrent upload-session requests in Cloudreve prior to 4.18.0 allow an authenticated user holding Files.Write permission - which the default User group provides - to bypass the per-account storage quota and reserve more space than the account is allowed, ultimately exhausting host disk and denying uploads to other users. The flaw is a time-of-check-to-time-of-use race: PrepareUpload validates capacity against a stale in-memory value while the actual storage charge is applied later and outside the same quota-enforcing transaction, so parallel requests that read the same snapshot all pass the MaxStorage check. Exploitation requires genuinely simultaneous requests and a valid low-privileged account, and impact is limited to availability (no data disclosure or code execution); no public exploit code was identified at time of analysis, and the issue is fixed in 4.18.0.
Unauthenticated administrator account creation in nginx-ignition affects deployments running versions prior to 2.41.1 that are still in their pre-onboarding state. The endpoint POST /api/users/onboarding/finish is registered as anonymous and, because its "onboarding already completed?" check is not atomic with the subsequent user write, a remote unauthenticated attacker (CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N, base 8.1) who can reach such an instance can create a full ReadWrite administrator account for themselves, and concurrent requests can create multiple admin accounts in a single race. No public exploit identified at time of analysis, and the practical window is narrow: exploitation requires the instance to be network-reachable while deployed but before a legitimate operator has completed onboarding - once onboarding is legitimately finished, the path is guarded.
An out-of-bounds write reachable through a race condition in google_mba_recv_msg() in google_mba_poll.c allows a locally installed low-privilege application on an affected Android device to corrupt kernel memory and escalate to system/kernel privileges. Rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N), the flaw requires no user interaction but does need the attacker to already run code on the device and to win a timing window, which keeps it materially below a remote, unauthenticated severity. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; no EPSS score was supplied in the source data.
Memory corruption in the ARM64 TLB-invalidation path of the Android kernel allows a local attacker holding low privileges to win a race condition and escalate to kernel/root privileges, with no user interaction and no additional execution privileges required. Affected builds are Google Android (CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), specifically ARM64 devices; Google's September 2026 Pixel security bulletin is the vendor reference for the fix. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed and no public exploit code has been identified at time of analysis.
Let me build the JSON. CVE-2026-58724: Android kernel use-after-free due to race condition, local EoP requiring System execution privileges, no UI. CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Reported by Google Devices. CPE: google:android. Tags: Privilege Escalation, Google, Race Condition. Reference: Android security bulletin September 2026 Pixel. Note: "System execution privileges needed" — this is Android bulletin phrasing meaning the attacker needs System-level privileges already... Actually in Android bulletins, "System execution privileges needed" means the vulnerability requires the attacker to already have System privileges? Hmm, actually Android bulletin says "This could lead to local escalation of privilege with System execution privileges needed" — meaning the attacker needs System execution privileges? Historically it means exploitation requires the attacker to run code with System privileges already... Actually it means the vulnerability can lead to local escalation of privilege with System execution privileges needed — i.e., it requires System-level privileges to exploit. That means privilege escalation from System to... hmm, in Android, "System" is a UID (system uid 1000). So it escalates to kernel. Actually "with System execution privileges needed" means the attacker must already have System privileges. CVSS PR:L is consistent-ish. Actually PR:L. Hmm but if System privileges needed, PR:H might be more apt. Given CVSS says PR:L, I'll assess PR:L... Hmm. My own assessment: AV:L/AC:H/PR:H? Let me think. The Android phrasing "System execution privileges needed" — needed to exploit — implies significant privileges already (system UID, not just any app). That's PR:H arguably. But CVSS gives PR:L. I'll go with PR:H? Let's be careful — I should ground my assessment in the description. The description says "with System execution privileges needed" — this means the exploit requires system-level privileges. So PR:H is honest. But the vendor's own CVSS says
A race condition in the trusty_dputc() debug output path of generic-arm64-smcall.c in the Android kernel allows an out-of-bounds write that can be leveraged for local privilege escalation. The flaw is only reachable by a process already running with System execution privileges, and exploitation requires winning a timing window (AC:H, PR:L), with no user interaction. Impact is high across confidentiality, integrity and availability because the corrupted memory is kernel/secure-monitor adjacent, but no public exploit code or in-the-wild exploitation is known from the available intelligence.
A use-after-free race condition in multiple locations of the Android kernel allows an attacker to corrupt kernel memory and escalate to remote code execution, affecting Android devices covered by the September 2026 Android Security Bulletin. Exploitation requires an attacker to already hold a low-privilege foothold on the device (CVSS PR:L) — typically a malicious or compromised application — and no user interaction is needed once that foothold exists. No public exploit code or CISA KEV listing was identified at time of analysis, so this is currently a patch-now kernel hardening issue rather than a confirmed in-the-wild campaign.
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
A race condition in Mozilla Firefox's XPConnect component allows an attacker who has already compromised execution inside the content/renderer sandbox to escape that boundary and reach higher-privileged browser code. Only Firefox builds prior to version 156 are affected; the flaw was fixed upstream and published in Mozilla's MFSA 2026-90/MFSA 2026-94 advisories. Exploitation is not a standalone remote code-execution path but a chained, timing-dependent step requiring a separate renderer compromise first, and no public exploit has been identified at time of analysis, with an EPSS score of just 0.14% (4th percentile) indicating low predicted real-world activity.
A race condition in Firefox's DOM: Content Processes component (CWE-362) lets attacker-controlled web content win a non-deterministic timing window and corrupt state inside the browser's content process, yielding high confidentiality and integrity impact; Mozilla fixed it in Firefox 156 and Firefox ESR 153.3. Reachable from any loaded page but gated by user interaction and a hard-to-reliably-win race (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5), the bug carries low exploitation likelihood signals (EPSS 0.15%, 5th percentile), is not on CISA KEV, and no public exploit code has been identified at time of analysis. All Firefox builds prior to the fixed releases match the affected CPE wildcard, so unpatched installations remain exposed to remote attackers who can persuade a user to open a crafted page.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
Local kernel memory corruption in Apple iOS and iPadOS (with parallel fixes in macOS, tvOS, visionOS and watchOS) lets an app already running on the device win a kernel race condition and either force an unexpected system termination or corrupt kernel memory, which can be leveraged toward full kernel read/write. Affected builds are iOS/iPadOS before 26.7 and before 27, macOS before 15.8, 26.7 (Tahoe) and 27 (Golden Gate), plus tvOS, visionOS and watchOS before 27; Apple has shipped fixes in every one of those branches. No public exploit code has been identified at time of analysis and EPSS is low at 0.18% (8th percentile), and because exploitation needs the attacker to already execute code as an app plus a timing-dependent race win, the vendor's own AV:L/PR:L vector (7.8 High) makes opportunistic mass exploitation impractical.
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Inventory integrity corruption in Snipe-IT ≤8.6.3 allows authenticated users holding consumable-checkout permission to over-allocate stock by exploiting a TOCTOU race condition in the API checkout endpoint. Concurrent POST requests to /api/v1/consumables/{consumable_id}/checkout each pass the pre-transaction availability check before either commits, enabling both to write checkout records and drive remaining inventory negative (e.g., a unit with 1 remaining ends at -1). Fixed in 8.7.0 via database row locking inside the transaction; no confirmed active exploitation at time of analysis, though proof-of-concept feasibility is noted by SSVC.
Remote unauthenticated retrieval of expired one-time secrets in PasswordPusher before 2.11.1 is enabled by a TOCTOU race condition in the expire_after_views view-limit enforcement logic. By issuing multiple simultaneous HTTP requests to the show endpoint, an attacker can read a secret that was configured to self-destruct after a single view, defeating the core confidentiality guarantee the tool is designed to provide. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, though the technique requires only basic HTTP concurrency tooling.
Race-condition-triggered code execution in Google Chrome's V8 JavaScript engine (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to execute arbitrary code inside the Chrome renderer sandbox by serving a crafted HTML page to a victim. Exploitation is constrained to the Chrome sandbox process rather than the underlying OS, which aligns with Chromium's own internal severity rating of 'Low' despite the CVSS base score of 7.5. No public exploit code or CISA KEV listing is present at time of analysis; the high attack complexity metric reflects the timing-sensitive nature of race-condition exploitation.
Sandbox-escape code execution via a race condition in the Google Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox. Affected builds are all Chrome versions prior to 153.0.8010.36 on Windows. The Chrome Updater's elevated-privilege execution context makes winning the race condition particularly impactful, as successful exploitation bypasses sandbox containment entirely.
Local privilege escalation in the Android common kernel's alloc.c memory allocation functions allows a low-privileged local user to gain full read/write access to kernel memory via a race condition. Multiple functions in alloc.c are affected, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the device. The vulnerability requires no user interaction and no elevated privileges beyond an existing local shell; Google addressed it in the September 2026 Android Security Bulletin with a patch committed to the Android common kernel repository.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.