Race Condition
Monthly
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Inventory integrity corruption in Snipe-IT ≤8.6.3 allows authenticated users holding consumable-checkout permission to over-allocate stock by exploiting a TOCTOU race condition in the API checkout endpoint. Concurrent POST requests to /api/v1/consumables/{consumable_id}/checkout each pass the pre-transaction availability check before either commits, enabling both to write checkout records and drive remaining inventory negative (e.g., a unit with 1 remaining ends at -1). Fixed in 8.7.0 via database row locking inside the transaction; no confirmed active exploitation at time of analysis, though proof-of-concept feasibility is noted by SSVC.
Remote unauthenticated retrieval of expired one-time secrets in PasswordPusher before 2.11.1 is enabled by a TOCTOU race condition in the expire_after_views view-limit enforcement logic. By issuing multiple simultaneous HTTP requests to the show endpoint, an attacker can read a secret that was configured to self-destruct after a single view, defeating the core confidentiality guarantee the tool is designed to provide. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, though the technique requires only basic HTTP concurrency tooling.
Race-condition-triggered code execution in Google Chrome's V8 JavaScript engine (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to execute arbitrary code inside the Chrome renderer sandbox by serving a crafted HTML page to a victim. Exploitation is constrained to the Chrome sandbox process rather than the underlying OS, which aligns with Chromium's own internal severity rating of 'Low' despite the CVSS base score of 7.5. No public exploit code or CISA KEV listing is present at time of analysis; the high attack complexity metric reflects the timing-sensitive nature of race-condition exploitation.
Sandbox-escape code execution via a race condition in the Google Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox. Affected builds are all Chrome versions prior to 153.0.8010.36 on Windows. The Chrome Updater's elevated-privilege execution context makes winning the race condition particularly impactful, as successful exploitation bypasses sandbox containment entirely.
Local privilege escalation in the Android common kernel's alloc.c memory allocation functions allows a low-privileged local user to gain full read/write access to kernel memory via a race condition. Multiple functions in alloc.c are affected, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the device. The vulnerability requires no user interaction and no elevated privileges beyond an existing local shell; Google addressed it in the September 2026 Android Security Bulletin with a patch committed to the Android common kernel repository.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Authentication Methods affects all supported Windows 10, Windows 11, and Windows Server releases through a use-after-free condition triggered via a race condition (CWE-362). An attacker with low-privileged local access can win a timing window in the authentication subsystem, corrupt freed memory, and elevate to full SYSTEM-level privileges with complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions - spanning every major Windows release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - makes this a high-priority patch for any Windows fleet.
Remote code execution in Windows DNS Server affects multiple Windows Server versions through a race condition on a shared resource during concurrent request processing. An unauthenticated network attacker can exploit the timing window to corrupt state and execute arbitrary code on the DNS Server host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the full CIA:H triad and network-accessible attack surface make this a credible high-priority patching target for any organization running Windows DNS Server.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in the Windows DNS Server component allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing. The CWE-362 flaw affects every actively supported Windows Server release from Server 2012 through Server 2025, with full confidentiality, integrity, and availability impact if exploited. No active exploitation or public proof-of-concept has been identified, and the CVSS AC:H rating reflects that reliable exploitation requires precise race-condition timing against a production DNS service.
Privilege escalation in Windows Hello on Windows 10 and 11 allows an authorized local attacker to elevate privileges beyond their current security boundary by exploiting a race condition in a shared resource. The vulnerability requires high initial privileges and high attack complexity due to race timing constraints, but successful exploitation yields scope-changed full C:H/I:H/A:H impact - consistent with SYSTEM-level compromise. Microsoft has released cumulative updates for all affected Windows 10 and Windows 11 builds; no public exploit code has been identified at time of analysis.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Privilege escalation in the Windows Bluetooth Service allows a low-privileged local attacker to gain SYSTEM-level access by exploiting a race condition in shared resource handling. Affected versions span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. Microsoft has released patched builds; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.
Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Null pointer dereference in ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) allows remote unauthenticated attackers to crash the CoAP server by submitting requests that trigger a race condition between the session dispatch and cleanup threads. The impact is confined to availability - the server process crashes, producing a denial-of-service condition with no confidentiality or integrity consequences. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.17% (7th percentile) places this in the lowest tier of current exploitation likelihood.
Privilege escalation in FreeBSD's tty subsystem allows a local unprivileged user to gain elevated privileges by exploiting a race condition in the TIOCSCTTY ioctl handler. The handler fails to revalidate terminal state after a lock-drop sequence, enabling a concurrently destroyed terminal to be incorrectly linked to the attacker's session. No public exploit code has been identified at time of analysis, but vendor-confirmed patches exist for all affected release lines (15.0-RELEASE, 15.1-RELEASE, and 14.4-RELEASE).
Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.
Remote code execution within the Chrome sandbox is achievable via a race condition in the V8 JavaScript engine, affecting all Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker (per CVSS PR:N) can trigger the vulnerability by luring a user to a crafted HTML page, exploiting a timing window in V8's memory management to execute arbitrary code. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.24th percentile and CISA SSVC records exploitation status as none, classifying this as a theoretical-but-patched risk for organizations that deploy promptly.
Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via a race condition in ANGLE, the graphics API translation layer. Exploitation requires a victim to visit a crafted HTML page (UI:R), and the high attack complexity (AC:H) reflects the timing-sensitive, probabilistic nature of race condition exploitation. No public exploit code has been identified and CISA KEV does not list this CVE, though SSVC rates technical impact as total if exploitation succeeds.
Race condition in Chrome's ReadAloud component allows remote code execution inside the browser sandbox when a user is socially engineered into visiting a crafted HTML page. Affected are all Google Chrome builds prior to 152.0.7977.65 across desktop platforms. The CVSS Scope:Changed metric signals a potential sandbox escape, elevating the impact beyond the renderer process to the underlying system, though EPSS (0.33%) and SSVC exploitation status of 'none' indicate no public exploit activity at time of analysis.
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point circuit negotiation, allowing a malicious relay operator acting as the rendezvous point to substitute itself for the intended onion service before the legitimate service completes authentication. The flaw affects all Tor application versions prior to 0.4.9.11 across all platforms. No public exploit code or active exploitation has been identified at time of analysis, but successful exploitation yields total interception and modification of traffic the client believes is reaching a private onion service.
Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.
Race condition in the authentication handler (`check.jst`) of RDK-B WebUI rdkb-2025q4-kirkstone allows remote unauthenticated attackers to bypass authentication by submitting concurrent login requests that exploit unsynchronized shared authentication state. Successful exploitation grants full administrative access to the broadband gateway device with high impact across confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.21% (12th percentile) reflects low observed exploitation activity despite the severity of the authentication bypass.
FreeBSD's ELF core dump subsystem contains a TOCTOU race condition that allows an unprivileged local user sharing an address space via rfork(2) to trigger a kernel heap out-of-bounds write, potentially escalating privileges to root. Affected releases are FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2, as confirmed in FreeBSD Security Advisory FreeBSD-SA-26:55.elf. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.
Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.
Local privilege escalation in the Windows Kernel affects Windows 11 (23H2 through 26H1) and Windows Server 2025, exploitable by any authenticated local user to gain SYSTEM-level access. The root mechanism is a use-after-free condition triggered through a race condition in kernel memory management, classified under CWE-362. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis; however, the kernel-level impact (C:H/I:H/A:H) makes it a high-priority patch target in enterprise and server environments.
Privilege escalation via use-after-free in the Windows DNS service exposes a broad range of Windows Server and Windows 10 systems to network-based attacks by unauthenticated adversaries. The race condition root cause (CWE-362) forces high attack complexity, as an attacker must win a precise timing window to corrupt freed memory and gain elevated privileges, reflected in the CVSS 8.1 score. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the full C/I/A impact across thirteen distinct product versions from Windows Server 2012 through Server 2025 warrants prompt patching.
Privilege escalation in Windows Telephony Service across a wide range of Microsoft Windows desktop and server editions enables a low-privileged local attacker to achieve SYSTEM-level control by exploiting a race condition in shared resource handling (CWE-362). The vulnerability spans Windows 10 through Windows 11 Version 25H2 and Windows Server 2012 through Server 2025, creating substantial attack surface despite the local access requirement. No public exploit identified at time of analysis; Microsoft has released patches resolving the flaw via the MSRC advisory for CVE-2026-62748.
Local privilege escalation via race condition in Windows Telephony Service affects a sweeping range of Microsoft Windows client and server editions, from Server 2012 through Windows 11 26H1. An authorized local attacker with low-privileged access can exploit improper synchronization over a shared resource to elevate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the breadth of affected Windows versions across enterprise environments makes unpatched exposure a meaningful operational risk.
Privilege escalation in Windows Telephony Service affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized local attacker exploits an improper synchronization flaw (CWE-362) in shared resource access within the telephony subsystem to elevate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability impact. Microsoft has released patched builds; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Privilege escalation in the Windows Bind Filter Driver exposes Windows 11 systems across three active release tracks to full SYSTEM-level compromise by locally authenticated low-privilege users exploiting a kernel race condition. Rated CVSS 7.0 with high attack complexity, the vulnerability reflects a timing-dependent flaw in shared kernel resource access rather than a simple code injection. No public exploit identified at time of analysis, and the vulnerability is absent from CISA KEV; Microsoft has released patches for all confirmed affected builds.
Windows MIDI Service Module on Windows 11 contains a race condition enabling a locally authenticated low-privileged attacker to escalate privileges to a higher-integrity context, with full confidentiality, integrity, and availability impact upon success. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 below specific patch thresholds confirmed by ENISA EUVD-2026-56345. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity (AC:H) reflects the timing-dependent nature of race condition exploitation, moderating real-world risk relative to the CVSS base score of 7.0.
Local privilege escalation in Windows Push Notifications exposes a broad range of Microsoft Windows desktop and server editions to full SYSTEM-level compromise by an authenticated low-privileged local attacker. The flaw is a race condition (CWE-362) in which concurrent threads access a shared resource without adequate synchronization, creating a timing window that can be manipulated to corrupt execution state and redirect control to a privileged context. Microsoft has confirmed the issue and released patches across all affected Windows build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Bind Filter Driver (bindflt.sys) permits a low-privileged local attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025 by exploiting a race condition that triggers a use-after-free in kernel memory. Affected builds span Windows 11 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations; Microsoft has released patched builds via the MSRC update guide. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.
Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.
Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.
Privilege escalation in Windows Telephony Service via an improper synchronization race condition (CWE-362) allows a locally authenticated, low-privilege attacker to gain full control over an affected system, achieving high confidentiality, integrity, and availability impact. The flaw spans an exceptionally broad range of Windows releases - from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025 - and Microsoft has issued patched builds through the MSRC update guide. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Remote code execution is achievable in llama.cpp's LLaMA-Android JNI wrapper (builds b1886 through b7445) by exploiting a race condition use-after-free between `bench_1model()` and `free_1context()`, which share the `llama_context` heap object without any synchronization primitive. An attacker who wins the race can perform a heap spray with a crafted fake vtable, overwriting the vtable pointer at offset +0x30 in `llama_batch_allocr` so that `clear()` dispatches to attacker-controlled memory, achieving code execution within the Android application process. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the fully documented vtable offset and exploitation technique substantially lower the development barrier for capable researchers.
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).
OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.
Local privilege escalation in ASUS Armoury Crate lets a low-privileged local user execute arbitrary code with elevated privileges by winning a race condition (CWE-362) and substituting a crafted file during a time-of-check/time-of-use window. The flaw affects the Armoury Crate system-management/control software bundled on ASUS consumer and gaming hardware, and although CVSS 4.0 rates it 7.3 (High), exploitation is local-only and requires precise timing (AT:P). There is no public exploit identified at time of analysis and no CISA KEV listing.
Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Google Chrome's V8 JavaScript engine (all versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though confined inside the renderer sandbox rather than achieving a full sandbox escape. Google rated the Chromium security severity as Low, and there is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation status: none). Exploitation hinges on winning a timing race, so despite the 7.5 CVSS score it is regarded as difficult to trigger reliably.
Sandbox escape in Google Chrome for macOS (versions before 151.0.7922.72) can be achieved by an attacker who has already compromised the renderer process, chaining a DevTools race condition via a crafted HTML page to break out of the renderer sandbox. Reported internally by the Chrome team and rated Medium by Chromium, it carries an NVD CVSS of 9.6 due to the scope change, though EPSS is very low (0.14%, 4th percentile). No public exploit identified at time of analysis and it is not on CISA KEV, indicating no confirmed active exploitation.
Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. There is no public exploit identified and EPSS is low (0.28%, 21st percentile), and CISA SSVC currently marks exploitation status as none.
Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. There is no public exploit identified at time of analysis, EPSS is low at 0.23%, and CISA SSVC records exploitation as 'none'.
Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Downloads component. Chromium rates it High severity and the CVSS is 9.6 (scope-changed). This is no public exploit identified at time of analysis; EPSS is low at 0.23% (14th percentile) and CISA SSVC records exploitation status as none.
Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.
We are tasked to produce a comprehensive analysis JSON for CVE-2026-62432. We must synthesize all provided data: CVE description, CVSS, tags, SSVC, references, etc. The output must be plain-text strings per field, no arrays, no markdown. First, parse the input: - CVE ID: CVE-2026-62432 - Description: "The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer." - CVSS: 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) - Reported by: security@xen.org - Tags: Denial Of Service, Race Condition - SSVC: Exploitation: none, Automatable: yes, Technical Impact: partial - ENISA EUVD ID: EUVD-2026-49785 - References include xenbits advisory, NVD, oss-security. No listed KEV status, no POC mention, no explicit patch version. The patch data is missing (we need to check references? Not provided explicitly. We must infer from multiple sources. The description mentions xen and hypercall, so it's a Xen hypervisor vulnerability. We need to fill out each field. Let's systematically analyze. - product_name: From description, "EVTCHNOP_expand_array hypercall" implies Xen hypervisor. The vulnerability is in Xen's event channel mechanism. So product is "Xen Hypervisor". Could also say "Xen", but "Xen Hypervisor" is 2 words. According to rule "1-3 words ONLY", "Xen Hypervisor" fits. - summary: Must be 2-3 sentence plain-language synthesis. Not copy description. Start with impact verb and product. Example: "Race condition in Xen Hypervisor can lead to denial of service via NULL pointer dereference." But also mention what attacker can do. The CVSS suggests partial impacts in C/I/A, so maybe more than DoS? But tags say Denial Of Service, Race Condition, and description says dereferencing NULL pointer, so likely denial of service (sys
Information disclosure in Xen hypervisor's CMOS emulation allows a guest VM to exploit a race condition in the index caching mechanism, leading to an out-of-bounds read of hypervisor memory. A malicious guest can repeatedly manipulate the CMOS index port while the hypervisor processes an access, potentially leaking sensitive data from the host or other VMs. No active exploitation or public exploit code is known at this time.
Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
Unexpected system termination and kernel memory corruption in macOS allows remote attackers to fully compromise a machine. The race condition (CWE-362) is triggered without authentication or user interaction, and Apple has released fixes in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is confirmed, and EPSS indicates a low probability of real-world attacks.
A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.
Local privilege escalation in macOS Sonoma 14.x before 14.8.8 and Sequoia 15.x before 15.7.8 allows a malicious app to gain elevated system privileges via a race condition. Apple has released patches, and no active exploitation or public proof-of-concept has been identified at this time.
Integrity modification in macOS Keychain allows remote unauthenticated attackers to modify Keychain state via a race condition. This vulnerability (CVE-2026-43728) is fixed in macOS Tahoe 26.6, with no known active exploitation but automatable according to SSVC. While CVSS rates it high severity, EPSS indicates very low likelihood of near-term exploitation.
Local privilege escalation in Apple macOS allows a low-privileged application to gain root privileges by exploiting a race condition in system state management. The issue is resolved in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. No active exploitation has been reported, but the local attack vector limits remote risk.
Privilege escalation in macOS via race condition allows a low-privileged local app to gain root privileges. The issue, tracked as CVE-2026-43693, was addressed with improved state handling and is fixed in the latest OS updates. No active exploitation has been reported and exploitation requires a local user account with high attack complexity, limiting immediate risk.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
A data race condition in the Linux kernel's audit subsystem allows local attackers to cause denial of service and minimal integrity impact by exploiting unsynchronized reads of the audit queue length. The flaw affects kernel versions from 4.10 through the unpatched stable series, triggered when concurrent readers and writers access the queue without proper locking,
A race condition in the Linux kernel's shrinker subsystem can cause use-after-free or double-free memory errors during memory cgroup creation and teardown. Local attackers with low privileges may exploit this to escalate privileges to kernel level, leading to full system compromise (confidentiality, integrity, and availability impact). Patches are available in multiple stable kernel branches; no active exploitation is reported (CISA KEV not listed), and the EPSS exploitation probability is low (0.21%).
We need to produce a comprehensive analysis for CVE-2026-64378 based on the provided data. The vulnerability is in the Linux kernel, specifically a race condition in writeback between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). The consequences are use-after-free and potential kernel crash/privilege escalation. The CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). EPSS 0.21% (low). KEV not mentioned, so not in CISA KEV. Tags: Information Disclosure, Linux. CWE N/A. Patch available from vendor. References to kernel.org commits. We need to fill each field: product_name: "Linux Kernel" (three words). The primary product is the Linux kernel. summary: 2-3 sentences, original synthesis, not paraphrasing. Start with impact verb and product: "Local privilege escalation via use-after-free race condition in Linux kernel's cgroup writeback mechanism allows a local attacker with low privileges to trigger a kernel crash or potentially execute arbitrary code." Need to mention affected product/version, attacker capability. EPSS low, KEV not present, POC? Not indicated as existing, but vuldb may have POC? Tags mention Information Disclosure, but impact is higher. Actually from description, it's a use-after-free in inode_switch_wbs_work_fn leading to potential code execution. CVSS 7.8 is high severity but local with low privs. I'll synthesize. technical_context: Underlying technology: Linux kernel's cgroup writeback (cgroup writeback) and the inode_switch_wbs() function that switches writeback ownership between cgroups, and the umount path (cgroup_writeback_umount). Root cause class is race condition (concurrent access to shared state without proper synchronization). CPE string confirms affected product: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions). The CWE is not provided, but would be likely CWE-362 (Race Condition) or CWE-416 (Use After Free). I'll mention the mechanism: the race between deactivating a superblock during umount and the wri
Local privilege escalation in the Linux kernel's I2C subsystem allows a low-privileged local attacker to compromise system integrity, confidentiality, and availability via a race condition during I2C adapter deregistration. The vulnerability affects kernel versions from 2.6.31 up to unpatched releases, with fixes available in stable trees 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code or active exploitation is currently reported, and EPSS indicates a low exploitation probability (0.21%).
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
We need to process CVE-2026-64189. The user wants a JSON with multiple fields, all plain text strings. We'll synthesize all provided data: description, EPSS, KEV? Not in input, KEV not mentioned, so assume no KEV. EPSS 0.16% low. Patch available from vendor? The patch data says "Patch: Available from vendor" but also shows Linux version ranges and patch commits. Tags: Canonical, Information Disclosure, Linux. CWE: N/A. CVSS: 7.8, vector local. We need to be careful: all fields must be strings, not arrays. The product_name: "Linux" (too generic? The affected product is the ipset subsystem in the Linux kernel's netfilter. So "Linux kernel" or "ipset"? The CPE is "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*" – that's the Linux kernel. I'll choose "Linux kernel". But the instruction says "1-3 words ONLY. The specific product or service name affected." Could be "Linux kernel", "netfilter ipset", maybe "Linux ipset". However, CPE says "linux:linux" which is the kernel. I'll go with "Linux kernel". Summary: need to synthesize description and mention EPSS, active exploitation status (none), POC? No mention of POC. So "no public exploit identified at time of analysis." But description has use-after-free in ipset dump race. So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during dump operations, potentially leading to memory corruption and privilege escalation." Need to mention EPSS low, no active exploitation. The CVSS is 7.8 (local, low privileges). So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during concurrent dump and resize operations, potentially achieving elevated privileges. No public exploit or active exploitation has been identified; EPSS score low (0.16%)." Technical_context: Explain the underlying technology: netfilter, ipset, netlink socket communication. Use-after-free due to missin
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. No public exploit is identified at time of analysis, but the flaw is credited by VulnCheck and carries a high CVSS 4.0 score of 9.2.
Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.
Heap use-after-free in FreeRDP's DRDYNVC dynamic-virtual-channel parser lets an authenticated RDP client crash or potentially execute code on a FreeRDP server running versions before 3.31.0. The flaw (CWE-362 race condition) is triggered by racing AUDIN channel-closure messages against DRDYNVC data parsing, causing the parser to dereference a channel pointer after the synchronization lock has been released. CVSS 4.0 rates it 7.7 (AV:N/AC:H/AT:P/PR:L/UI:N, high C/I/A), so a valid session and precise timing are required; no public exploit code or CISA KEV entry was identified at time of analysis.
Race condition in Apple's kernel state management lets a malicious sandboxed app escape its sandbox and execute arbitrary code with kernel privileges on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Exploitation requires a timing window to be won (CVSS AC:H) but no user interaction beyond launching the app, and success yields full control of the affected device. Apple shipped fixes in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; no public exploit code or CISA KEV listing was present in the provided data, and no EPSS
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Inventory integrity corruption in Snipe-IT ≤8.6.3 allows authenticated users holding consumable-checkout permission to over-allocate stock by exploiting a TOCTOU race condition in the API checkout endpoint. Concurrent POST requests to /api/v1/consumables/{consumable_id}/checkout each pass the pre-transaction availability check before either commits, enabling both to write checkout records and drive remaining inventory negative (e.g., a unit with 1 remaining ends at -1). Fixed in 8.7.0 via database row locking inside the transaction; no confirmed active exploitation at time of analysis, though proof-of-concept feasibility is noted by SSVC.
Remote unauthenticated retrieval of expired one-time secrets in PasswordPusher before 2.11.1 is enabled by a TOCTOU race condition in the expire_after_views view-limit enforcement logic. By issuing multiple simultaneous HTTP requests to the show endpoint, an attacker can read a secret that was configured to self-destruct after a single view, defeating the core confidentiality guarantee the tool is designed to provide. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified, though the technique requires only basic HTTP concurrency tooling.
Race-condition-triggered code execution in Google Chrome's V8 JavaScript engine (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to execute arbitrary code inside the Chrome renderer sandbox by serving a crafted HTML page to a victim. Exploitation is constrained to the Chrome sandbox process rather than the underlying OS, which aligns with Chromium's own internal severity rating of 'Low' despite the CVSS base score of 7.5. No public exploit code or CISA KEV listing is present at time of analysis; the high attack complexity metric reflects the timing-sensitive nature of race-condition exploitation.
Sandbox-escape code execution via a race condition in the Google Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox. Affected builds are all Chrome versions prior to 153.0.8010.36 on Windows. The Chrome Updater's elevated-privilege execution context makes winning the race condition particularly impactful, as successful exploitation bypasses sandbox containment entirely.
Local privilege escalation in the Android common kernel's alloc.c memory allocation functions allows a low-privileged local user to gain full read/write access to kernel memory via a race condition. Multiple functions in alloc.c are affected, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the device. The vulnerability requires no user interaction and no elevated privileges beyond an existing local shell; Google addressed it in the September 2026 Android Security Bulletin with a patch committed to the Android common kernel repository.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Authentication Methods affects all supported Windows 10, Windows 11, and Windows Server releases through a use-after-free condition triggered via a race condition (CWE-362). An attacker with low-privileged local access can win a timing window in the authentication subsystem, corrupt freed memory, and elevate to full SYSTEM-level privileges with complete confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions - spanning every major Windows release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - makes this a high-priority patch for any Windows fleet.
Remote code execution in Windows DNS Server affects multiple Windows Server versions through a race condition on a shared resource during concurrent request processing. An unauthenticated network attacker can exploit the timing window to corrupt state and execute arbitrary code on the DNS Server host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the full CIA:H triad and network-accessible attack surface make this a credible high-priority patching target for any organization running Windows DNS Server.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in the Windows DNS Server component allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing. The CWE-362 flaw affects every actively supported Windows Server release from Server 2012 through Server 2025, with full confidentiality, integrity, and availability impact if exploited. No active exploitation or public proof-of-concept has been identified, and the CVSS AC:H rating reflects that reliable exploitation requires precise race-condition timing against a production DNS service.
Privilege escalation in Windows Hello on Windows 10 and 11 allows an authorized local attacker to elevate privileges beyond their current security boundary by exploiting a race condition in a shared resource. The vulnerability requires high initial privileges and high attack complexity due to race timing constraints, but successful exploitation yields scope-changed full C:H/I:H/A:H impact - consistent with SYSTEM-level compromise. Microsoft has released cumulative updates for all affected Windows 10 and Windows 11 builds; no public exploit code has been identified at time of analysis.
Privilege escalation in Windows Host Guardian Service (HGS) allows a low-privileged local attacker to gain SYSTEM-level access through a use-after-free memory corruption triggered by a race condition. Affected products span Windows 10 and 11 client editions alongside Windows Server 2019, 2022, and 2025, covering a broad enterprise and consumer Windows footprint across multiple build lines. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Device Association Service exposes all supported Windows client and server editions to full system compromise by a low-privileged local attacker. The root cause is a use-after-free triggered through a race condition (CWE-362): concurrent access to a shared resource in the Device Association Service allows a freed memory object to be reused, enabling controlled code execution in a higher-privilege context. No public exploit or CISA KEV listing is present at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 R2 through 2025 - makes this a high-priority patch for any environment with untrusted local users.
Privilege escalation in the Windows Bluetooth Service allows a low-privileged local attacker to gain SYSTEM-level access by exploiting a race condition in shared resource handling. Affected versions span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. Microsoft has released patched builds; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Race condition exploitation in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers allows any local non-privileged process to perform improper GPU memory operations, yielding kernel-level sensitive information disclosure or denial of service. All three driver families are affected across broad version ranges spanning multiple major release trains - Bifrost from r12p0, Valhall from r19p0, and 5th Gen from r41p0 - covering a large installed base of Mali GPU-equipped devices. No public exploit or active exploitation has been confirmed at time of analysis; the low EPSS score (0.11%, percentile 1%) reflects limited observed exploitation interest.
Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Null pointer dereference in ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5) allows remote unauthenticated attackers to crash the CoAP server by submitting requests that trigger a race condition between the session dispatch and cleanup threads. The impact is confined to availability - the server process crashes, producing a denial-of-service condition with no confidentiality or integrity consequences. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.17% (7th percentile) places this in the lowest tier of current exploitation likelihood.
Privilege escalation in FreeBSD's tty subsystem allows a local unprivileged user to gain elevated privileges by exploiting a race condition in the TIOCSCTTY ioctl handler. The handler fails to revalidate terminal state after a lock-drop sequence, enabling a concurrently destroyed terminal to be incorrectly linked to the attacker's session. No public exploit code has been identified at time of analysis, but vendor-confirmed patches exist for all affected release lines (15.0-RELEASE, 15.1-RELEASE, and 14.4-RELEASE).
Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.
Remote code execution within the Chrome sandbox is achievable via a race condition in the V8 JavaScript engine, affecting all Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker (per CVSS PR:N) can trigger the vulnerability by luring a user to a crafted HTML page, exploiting a timing window in V8's memory management to execute arbitrary code. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.24th percentile and CISA SSVC records exploitation status as none, classifying this as a theoretical-but-patched risk for organizations that deploy promptly.
Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via a race condition in ANGLE, the graphics API translation layer. Exploitation requires a victim to visit a crafted HTML page (UI:R), and the high attack complexity (AC:H) reflects the timing-sensitive, probabilistic nature of race condition exploitation. No public exploit code has been identified and CISA KEV does not list this CVE, though SSVC rates technical impact as total if exploitation succeeds.
Race condition in Chrome's ReadAloud component allows remote code execution inside the browser sandbox when a user is socially engineered into visiting a crafted HTML page. Affected are all Google Chrome builds prior to 152.0.7977.65 across desktop platforms. The CVSS Scope:Changed metric signals a potential sandbox escape, elevating the impact beyond the renderer process to the underlying system, though EPSS (0.33%) and SSVC exploitation status of 'none' indicate no public exploit activity at time of analysis.
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point circuit negotiation, allowing a malicious relay operator acting as the rendezvous point to substitute itself for the intended onion service before the legitimate service completes authentication. The flaw affects all Tor application versions prior to 0.4.9.11 across all platforms. No public exploit code or active exploitation has been identified at time of analysis, but successful exploitation yields total interception and modification of traffic the client believes is reaching a private onion service.
Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.
Race condition in the authentication handler (`check.jst`) of RDK-B WebUI rdkb-2025q4-kirkstone allows remote unauthenticated attackers to bypass authentication by submitting concurrent login requests that exploit unsynchronized shared authentication state. Successful exploitation grants full administrative access to the broadband gateway device with high impact across confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.21% (12th percentile) reflects low observed exploitation activity despite the severity of the authentication bypass.
FreeBSD's ELF core dump subsystem contains a TOCTOU race condition that allows an unprivileged local user sharing an address space via rfork(2) to trigger a kernel heap out-of-bounds write, potentially escalating privileges to root. Affected releases are FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2, as confirmed in FreeBSD Security Advisory FreeBSD-SA-26:55.elf. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.
Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.
Local privilege escalation in the Windows Kernel affects Windows 11 (23H2 through 26H1) and Windows Server 2025, exploitable by any authenticated local user to gain SYSTEM-level access. The root mechanism is a use-after-free condition triggered through a race condition in kernel memory management, classified under CWE-362. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis; however, the kernel-level impact (C:H/I:H/A:H) makes it a high-priority patch target in enterprise and server environments.
Privilege escalation via use-after-free in the Windows DNS service exposes a broad range of Windows Server and Windows 10 systems to network-based attacks by unauthenticated adversaries. The race condition root cause (CWE-362) forces high attack complexity, as an attacker must win a precise timing window to corrupt freed memory and gain elevated privileges, reflected in the CVSS 8.1 score. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the full C/I/A impact across thirteen distinct product versions from Windows Server 2012 through Server 2025 warrants prompt patching.
Privilege escalation in Windows Telephony Service across a wide range of Microsoft Windows desktop and server editions enables a low-privileged local attacker to achieve SYSTEM-level control by exploiting a race condition in shared resource handling (CWE-362). The vulnerability spans Windows 10 through Windows 11 Version 25H2 and Windows Server 2012 through Server 2025, creating substantial attack surface despite the local access requirement. No public exploit identified at time of analysis; Microsoft has released patches resolving the flaw via the MSRC advisory for CVE-2026-62748.
Local privilege escalation via race condition in Windows Telephony Service affects a sweeping range of Microsoft Windows client and server editions, from Server 2012 through Windows 11 26H1. An authorized local attacker with low-privileged access can exploit improper synchronization over a shared resource to elevate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the breadth of affected Windows versions across enterprise environments makes unpatched exposure a meaningful operational risk.
Privilege escalation in Windows Telephony Service affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized local attacker exploits an improper synchronization flaw (CWE-362) in shared resource access within the telephony subsystem to elevate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability impact. Microsoft has released patched builds; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Privilege escalation in the Windows Bind Filter Driver exposes Windows 11 systems across three active release tracks to full SYSTEM-level compromise by locally authenticated low-privilege users exploiting a kernel race condition. Rated CVSS 7.0 with high attack complexity, the vulnerability reflects a timing-dependent flaw in shared kernel resource access rather than a simple code injection. No public exploit identified at time of analysis, and the vulnerability is absent from CISA KEV; Microsoft has released patches for all confirmed affected builds.
Windows MIDI Service Module on Windows 11 contains a race condition enabling a locally authenticated low-privileged attacker to escalate privileges to a higher-integrity context, with full confidentiality, integrity, and availability impact upon success. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 below specific patch thresholds confirmed by ENISA EUVD-2026-56345. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity (AC:H) reflects the timing-dependent nature of race condition exploitation, moderating real-world risk relative to the CVSS base score of 7.0.
Local privilege escalation in Windows Push Notifications exposes a broad range of Microsoft Windows desktop and server editions to full SYSTEM-level compromise by an authenticated low-privileged local attacker. The flaw is a race condition (CWE-362) in which concurrent threads access a shared resource without adequate synchronization, creating a timing window that can be manipulated to corrupt execution state and redirect control to a privileged context. Microsoft has confirmed the issue and released patches across all affected Windows build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Bind Filter Driver (bindflt.sys) permits a low-privileged local attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025 by exploiting a race condition that triggers a use-after-free in kernel memory. Affected builds span Windows 11 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations; Microsoft has released patched builds via the MSRC update guide. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.
Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.
Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.
Privilege escalation in Windows Telephony Service via an improper synchronization race condition (CWE-362) allows a locally authenticated, low-privilege attacker to gain full control over an affected system, achieving high confidentiality, integrity, and availability impact. The flaw spans an exceptionally broad range of Windows releases - from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025 - and Microsoft has issued patched builds through the MSRC update guide. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Remote code execution is achievable in llama.cpp's LLaMA-Android JNI wrapper (builds b1886 through b7445) by exploiting a race condition use-after-free between `bench_1model()` and `free_1context()`, which share the `llama_context` heap object without any synchronization primitive. An attacker who wins the race can perform a heap spray with a crafted fake vtable, overwriting the vtable pointer at offset +0x30 in `llama_batch_allocr` so that `clear()` dispatches to attacker-controlled memory, achieving code execution within the Android application process. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the fully documented vtable offset and exploitation technique substantially lower the development barrier for capable researchers.
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).
OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.
Local privilege escalation in ASUS Armoury Crate lets a low-privileged local user execute arbitrary code with elevated privileges by winning a race condition (CWE-362) and substituting a crafted file during a time-of-check/time-of-use window. The flaw affects the Armoury Crate system-management/control software bundled on ASUS consumer and gaming hardware, and although CVSS 4.0 rates it 7.3 (High), exploitation is local-only and requires precise timing (AT:P). There is no public exploit identified at time of analysis and no CISA KEV listing.
Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Google Chrome's V8 JavaScript engine (all versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though confined inside the renderer sandbox rather than achieving a full sandbox escape. Google rated the Chromium security severity as Low, and there is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation status: none). Exploitation hinges on winning a timing race, so despite the 7.5 CVSS score it is regarded as difficult to trigger reliably.
Sandbox escape in Google Chrome for macOS (versions before 151.0.7922.72) can be achieved by an attacker who has already compromised the renderer process, chaining a DevTools race condition via a crafted HTML page to break out of the renderer sandbox. Reported internally by the Chrome team and rated Medium by Chromium, it carries an NVD CVSS of 9.6 due to the scope change, though EPSS is very low (0.14%, 4th percentile). No public exploit identified at time of analysis and it is not on CISA KEV, indicating no confirmed active exploitation.
Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. There is no public exploit identified and EPSS is low (0.28%, 21st percentile), and CISA SSVC currently marks exploitation status as none.
Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. There is no public exploit identified at time of analysis, EPSS is low at 0.23%, and CISA SSVC records exploitation as 'none'.
Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Downloads component. Chromium rates it High severity and the CVSS is 9.6 (scope-changed). This is no public exploit identified at time of analysis; EPSS is low at 0.23% (14th percentile) and CISA SSVC records exploitation status as none.
Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.
We are tasked to produce a comprehensive analysis JSON for CVE-2026-62432. We must synthesize all provided data: CVE description, CVSS, tags, SSVC, references, etc. The output must be plain-text strings per field, no arrays, no markdown. First, parse the input: - CVE ID: CVE-2026-62432 - Description: "The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer." - CVSS: 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) - Reported by: security@xen.org - Tags: Denial Of Service, Race Condition - SSVC: Exploitation: none, Automatable: yes, Technical Impact: partial - ENISA EUVD ID: EUVD-2026-49785 - References include xenbits advisory, NVD, oss-security. No listed KEV status, no POC mention, no explicit patch version. The patch data is missing (we need to check references? Not provided explicitly. We must infer from multiple sources. The description mentions xen and hypercall, so it's a Xen hypervisor vulnerability. We need to fill out each field. Let's systematically analyze. - product_name: From description, "EVTCHNOP_expand_array hypercall" implies Xen hypervisor. The vulnerability is in Xen's event channel mechanism. So product is "Xen Hypervisor". Could also say "Xen", but "Xen Hypervisor" is 2 words. According to rule "1-3 words ONLY", "Xen Hypervisor" fits. - summary: Must be 2-3 sentence plain-language synthesis. Not copy description. Start with impact verb and product. Example: "Race condition in Xen Hypervisor can lead to denial of service via NULL pointer dereference." But also mention what attacker can do. The CVSS suggests partial impacts in C/I/A, so maybe more than DoS? But tags say Denial Of Service, Race Condition, and description says dereferencing NULL pointer, so likely denial of service (sys
Information disclosure in Xen hypervisor's CMOS emulation allows a guest VM to exploit a race condition in the index caching mechanism, leading to an out-of-bounds read of hypervisor memory. A malicious guest can repeatedly manipulate the CMOS index port while the hypervisor processes an access, potentially leaking sensitive data from the host or other VMs. No active exploitation or public exploit code is known at this time.
Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.
Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.
Unexpected system termination and kernel memory corruption in macOS allows remote attackers to fully compromise a machine. The race condition (CWE-362) is triggered without authentication or user interaction, and Apple has released fixes in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is confirmed, and EPSS indicates a low probability of real-world attacks.
A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.
Local privilege escalation in macOS Sonoma 14.x before 14.8.8 and Sequoia 15.x before 15.7.8 allows a malicious app to gain elevated system privileges via a race condition. Apple has released patches, and no active exploitation or public proof-of-concept has been identified at this time.
Integrity modification in macOS Keychain allows remote unauthenticated attackers to modify Keychain state via a race condition. This vulnerability (CVE-2026-43728) is fixed in macOS Tahoe 26.6, with no known active exploitation but automatable according to SSVC. While CVSS rates it high severity, EPSS indicates very low likelihood of near-term exploitation.
Local privilege escalation in Apple macOS allows a low-privileged application to gain root privileges by exploiting a race condition in system state management. The issue is resolved in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. No active exploitation has been reported, but the local attack vector limits remote risk.
Privilege escalation in macOS via race condition allows a low-privileged local app to gain root privileges. The issue, tracked as CVE-2026-43693, was addressed with improved state handling and is fixed in the latest OS updates. No active exploitation has been reported and exploitation requires a local user account with high attack complexity, limiting immediate risk.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
A data race condition in the Linux kernel's audit subsystem allows local attackers to cause denial of service and minimal integrity impact by exploiting unsynchronized reads of the audit queue length. The flaw affects kernel versions from 4.10 through the unpatched stable series, triggered when concurrent readers and writers access the queue without proper locking,
A race condition in the Linux kernel's shrinker subsystem can cause use-after-free or double-free memory errors during memory cgroup creation and teardown. Local attackers with low privileges may exploit this to escalate privileges to kernel level, leading to full system compromise (confidentiality, integrity, and availability impact). Patches are available in multiple stable kernel branches; no active exploitation is reported (CISA KEV not listed), and the EPSS exploitation probability is low (0.21%).
We need to produce a comprehensive analysis for CVE-2026-64378 based on the provided data. The vulnerability is in the Linux kernel, specifically a race condition in writeback between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). The consequences are use-after-free and potential kernel crash/privilege escalation. The CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). EPSS 0.21% (low). KEV not mentioned, so not in CISA KEV. Tags: Information Disclosure, Linux. CWE N/A. Patch available from vendor. References to kernel.org commits. We need to fill each field: product_name: "Linux Kernel" (three words). The primary product is the Linux kernel. summary: 2-3 sentences, original synthesis, not paraphrasing. Start with impact verb and product: "Local privilege escalation via use-after-free race condition in Linux kernel's cgroup writeback mechanism allows a local attacker with low privileges to trigger a kernel crash or potentially execute arbitrary code." Need to mention affected product/version, attacker capability. EPSS low, KEV not present, POC? Not indicated as existing, but vuldb may have POC? Tags mention Information Disclosure, but impact is higher. Actually from description, it's a use-after-free in inode_switch_wbs_work_fn leading to potential code execution. CVSS 7.8 is high severity but local with low privs. I'll synthesize. technical_context: Underlying technology: Linux kernel's cgroup writeback (cgroup writeback) and the inode_switch_wbs() function that switches writeback ownership between cgroups, and the umount path (cgroup_writeback_umount). Root cause class is race condition (concurrent access to shared state without proper synchronization). CPE string confirms affected product: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (all versions). The CWE is not provided, but would be likely CWE-362 (Race Condition) or CWE-416 (Use After Free). I'll mention the mechanism: the race between deactivating a superblock during umount and the wri
Local privilege escalation in the Linux kernel's I2C subsystem allows a low-privileged local attacker to compromise system integrity, confidentiality, and availability via a race condition during I2C adapter deregistration. The vulnerability affects kernel versions from 2.6.31 up to unpatched releases, with fixes available in stable trees 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1. No public exploit code or active exploitation is currently reported, and EPSS indicates a low exploitation probability (0.21%).
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
We need to process CVE-2026-64189. The user wants a JSON with multiple fields, all plain text strings. We'll synthesize all provided data: description, EPSS, KEV? Not in input, KEV not mentioned, so assume no KEV. EPSS 0.16% low. Patch available from vendor? The patch data says "Patch: Available from vendor" but also shows Linux version ranges and patch commits. Tags: Canonical, Information Disclosure, Linux. CWE: N/A. CVSS: 7.8, vector local. We need to be careful: all fields must be strings, not arrays. The product_name: "Linux" (too generic? The affected product is the ipset subsystem in the Linux kernel's netfilter. So "Linux kernel" or "ipset"? The CPE is "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*" – that's the Linux kernel. I'll choose "Linux kernel". But the instruction says "1-3 words ONLY. The specific product or service name affected." Could be "Linux kernel", "netfilter ipset", maybe "Linux ipset". However, CPE says "linux:linux" which is the kernel. I'll go with "Linux kernel". Summary: need to synthesize description and mention EPSS, active exploitation status (none), POC? No mention of POC. So "no public exploit identified at time of analysis." But description has use-after-free in ipset dump race. So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during dump operations, potentially leading to memory corruption and privilege escalation." Need to mention EPSS low, no active exploitation. The CVSS is 7.8 (local, low privileges). So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during concurrent dump and resize operations, potentially achieving elevated privileges. No public exploit or active exploitation has been identified; EPSS score low (0.16%)." Technical_context: Explain the underlying technology: netfilter, ipset, netlink socket communication. Use-after-free due to missin
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-active authenticated sessions via a TOCTOU race condition on the HTTP /rpc endpoint — the primary interface used by all official SurrealDB SDKs. Because concurrent requests share mutable authentication state, an unauthenticated request that races in before the state is cleared executes as the authenticated user, potentially escalating to root. No public exploit is identified at time of analysis, but the flaw is credited by VulnCheck and carries a high CVSS 4.0 score of 9.2.
Local privilege escalation and denial of service in the Linux kernel's I2C core subsystem arises because an I2C adapter is added to the global IDR lookup table before its embedded struct device is fully initialised. Because i2c_get_adapter() and the i2c-dev chardev (registered via a bus notifier) can look up an adapter by id and take a reference to that device during this window, a concurrent caller can access uninitialised data, leading to NULL-pointer dereference or use-after-free. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the fix has been merged and backported across stable trees.