Race Condition

Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.

Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.

Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.

Copilot Chat in Microsoft Edge (Chromium-based) exposes a race condition that enables an authorized, low-privileged attacker to disclose information across a component scope boundary over the network. The flaw arises from improper synchronization of concurrent access to a shared resource within the Copilot Chat feature, producing partial confidentiality and, per the official CVSS vector, limited integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.

Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.

Privilege escalation in FreeBSD's tty subsystem allows a local unprivileged user to gain elevated privileges by exploiting a race condition in the TIOCSCTTY ioctl handler. The handler fails to revalidate terminal state after a lock-drop sequence, enabling a concurrently destroyed terminal to be incorrectly linked to the attacker's session. No public exploit code has been identified at time of analysis, but vendor-confirmed patches exist for all affected release lines (15.0-RELEASE, 15.1-RELEASE, and 14.4-RELEASE).

Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.

Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.

Remote code execution within the Chrome sandbox is achievable via a race condition in the V8 JavaScript engine, affecting all Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker (per CVSS PR:N) can trigger the vulnerability by luring a user to a crafted HTML page, exploiting a timing window in V8's memory management to execute arbitrary code. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.24th percentile and CISA SSVC records exploitation status as none, classifying this as a theoretical-but-patched risk for organizations that deploy promptly.

Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.

Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via a race condition in ANGLE, the graphics API translation layer. Exploitation requires a victim to visit a crafted HTML page (UI:R), and the high attack complexity (AC:H) reflects the timing-sensitive, probabilistic nature of race condition exploitation. No public exploit code has been identified and CISA KEV does not list this CVE, though SSVC rates technical impact as total if exploitation succeeds.

Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.

Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.

Race condition in Chrome's ReadAloud component allows remote code execution inside the browser sandbox when a user is socially engineered into visiting a crafted HTML page. Affected are all Google Chrome builds prior to 152.0.7977.65 across desktop platforms. The CVSS Scope:Changed metric signals a potential sandbox escape, elevating the impact beyond the renderer process to the underlying system, though EPSS (0.33%) and SSVC exploitation status of 'none' indicate no public exploit activity at time of analysis.

Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point circuit negotiation, allowing a malicious relay operator acting as the rendezvous point to substitute itself for the intended onion service before the legitimate service completes authentication. The flaw affects all Tor application versions prior to 0.4.9.11 across all platforms. No public exploit code or active exploitation has been identified at time of analysis, but successful exploitation yields total interception and modification of traffic the client believes is reaching a private onion service.

Process-crashing race condition in the OpenTelemetry-Go OpenTracing bridge (`go.opentelemetry.io/otel/bridge/opentracing`) allows denial of service when concurrent goroutines access the same `bridgeSpan` - one writing baggage via `SetBaggageItem` and another reading it via `correlation.MapFromContext`. Because Go's runtime detects unsynchronized map access and terminates the process with a fatal panic, any application using the bridge with correlation hooks and concurrent span access is vulnerable to abrupt process termination. A proof-of-concept is publicly available; no confirmed active exploitation (KEV) has been reported.

Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.

Unauthenticated model content injection in Splunk AI Toolkit below 6.0.0 allows an authenticated attacker with model upload privileges to overwrite another user's in-progress model upload by racing concurrent requests to the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The root cause is the toolkit's failure to bind uploaded file content to the specific request that creates the corresponding model lookup entry, enabling a TOCTOU-style substitution. No public exploit code or CISA KEV listing has been identified; the vendor (Splunk) has released a patch in version 6.0.0.

Privilege escalation in the Windows Telephony Service (TapiSrv) allows an authenticated local attacker with low-privilege access to gain SYSTEM-level privileges by exploiting a race condition in how the service handles concurrent access to shared resources. Affected products span Windows 10 (multiple feature releases), Windows 11, and Windows Server 2012 through 2025, representing a broad swath of the Microsoft ecosystem. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via the Microsoft Security Response Center.

Race condition in the authentication handler (`check.jst`) of RDK-B WebUI rdkb-2025q4-kirkstone allows remote unauthenticated attackers to bypass authentication by submitting concurrent login requests that exploit unsynchronized shared authentication state. Successful exploitation grants full administrative access to the broadband gateway device with high impact across confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.21% (12th percentile) reflects low observed exploitation activity despite the severity of the authentication bypass.

FreeBSD's ELF core dump subsystem contains a TOCTOU race condition that allows an unprivileged local user sharing an address space via rfork(2) to trigger a kernel heap out-of-bounds write, potentially escalating privileges to root. Affected releases are FreeBSD 14.4-RELEASE prior to p8, 15.0-RELEASE prior to p12, and 15.1-RELEASE prior to p2, as confirmed in FreeBSD Security Advisory FreeBSD-SA-26:55.elf. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Race condition in Firefox's JavaScript Engine (CVE-2026-74984) exposes users on all Firefox versions prior to 154 and ESR versions prior to 153.1 to potential confidentiality and integrity compromise. The CWE-362 flaw creates a timing window during concurrent JavaScript execution in which an attacker-controlled script can race against the engine's internal state management, enabling memory read or write access. No public exploit code has been identified and EPSS sits at the 5th percentile, indicating no widespread exploitation at time of analysis.

Login lockout bypass in Zabbix API and Frontend enables brute-force attacks beyond intended limits by exploiting a race condition in the block counter. Simultaneous login requests are not properly synchronized against the lockout mechanism, allowing unauthenticated remote attackers to submit more credential guesses than the lockout policy permits. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, no-authentication-required attack surface lowers the barrier for credential-stuffing campaigns against Zabbix deployments.

Memory corruption via race condition in Safari's web content processing causes unexpected application crashes on iOS, iPadOS, and macOS. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2, covering both the legacy 18.x and current 26.x release trains. No public exploit identified at time of analysis, and exploitation requires high attack complexity due to the race condition timing requirement, making opportunistic mass exploitation unlikely.

Memory corruption via a race condition in Apple's web content processing engine (WebKit) causes Safari to crash when a user loads maliciously crafted content on iOS, iPadOS, or macOS Tahoe. The root cause is an improper locking deficiency (CWE-362), confirmed by Apple's own description of the fix as "improved locking." No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Apple has released patches across all affected platforms.

Quota bypass via Redis cache race condition in New API (QuantumNous LLM gateway) allows any authenticated low-privilege user to keep their cached quota balance artificially inflated by flooding PUT /api/user/self with settings updates while concurrently consuming quota. The settings update path reads a stale full User snapshot and writes it back via RedisHSetObj, atomically overwriting HINCRBY billing deductions applied by concurrent relay requests to the same Redis hash key. No public exploit has been identified and the vulnerability is not listed in CISA KEV; however, the financial integrity impact on operators is concrete, as affected users can make LLM API calls well beyond their paid allocation without detection until a database reconciliation occurs.

Race condition in KUNBUS piControl 2.6.2 enables a local authenticated attacker to corrupt kernel heap memory and disclose adjacent kernel memory contents by issuing concurrent crafted requests through the piControl character device. The flaw resides in the event notification subsystem, where improper synchronization between threads allows an attacker to win a timing window and manipulate shared kernel state. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high-complexity, local-access nature of the attack.

Race condition exploitation in KUNBUS piControl 2.6.2 allows a local authenticated attacker to corrupt kernel memory by issuing concurrent crafted requests through the piControl character device, triggering use-after-free and invalid pointer dereferences in kernel configuration objects. The flaw resides in the configuration and process-image management subsystem of this industrial Revolution Pi (RevPi) controller platform component, with potential impact spanning confidentiality, integrity, and availability per the CVSS 4.0 vector, though denial of service is the explicitly confirmed outcome. No public exploit code and no active exploitation have been identified at time of analysis; this was responsibly disclosed by Nozomi Networks Labs.

Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant guard introduced for CVE-2025-62164, permitting an invalid sparse tensor to reach `tensor.to_dense()` and cause availability disruption. Affected deployments span versions 0.20.2rc0 through 0.25.x and are limited to instances with `enable_prompt_embeds` explicitly enabled. No public exploit code or CISA KEV listing exists at time of analysis; the fix is confirmed in v0.26.0.

Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.

Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. IBM has released a patch via advisory 7282770, and no public exploit has been identified at time of analysis.

IBM i versions 7.3 through 7.6 expose sensitive information to remote authenticated attackers via a race condition (CWE-362). The flaw allows a low-privileged network-authenticated user to read data outside their authorization boundary during a timing window in an undisclosed subsystem. Vendor-released patch is available; no public exploit code exists and the vulnerability is not listed in CISA KEV.

Remote authenticated exploitation of a race condition in IBM i 7.3 through 7.6 allows attackers with low-privilege credentials to obtain sensitive information and bypass platform security restrictions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over the network without user interaction, though authentication is required. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via its support portal.

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().

In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD lock debugging is enabled, async !wait calls use the destination CPU csd_data. That improves diagnostics, but it also removes the single-writer property that made the old csd_lock() safe: multiple CPUs can now prepare the same destination CPU CSD concurrently. csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the bit with a non-atomic read-modify-write. Two senders can both see an unlocked CSD, set the bit, overwrite the callback fields, and enqueue the same llist node. Re-adding a node that is already the queue head can make node->next point to itself, leaving the target CPU stuck walking call_single_queue. Later synchronous work, such as a TLB shootdown, can then remain queued and trigger soft-lockup warnings or panics. Keep the single csd_lock() implementation, but when CSD lock debugging is enabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the destination CPU CSD a real atomic lock in the only configuration where it can be shared by multiple remote senders, while preserving the existing non-debug fast path.

In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost.

Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.

Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.

Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.

Local privilege escalation in the Windows Kernel affects Windows 11 (23H2 through 26H1) and Windows Server 2025, exploitable by any authenticated local user to gain SYSTEM-level access. The root mechanism is a use-after-free condition triggered through a race condition in kernel memory management, classified under CWE-362. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis; however, the kernel-level impact (C:H/I:H/A:H) makes it a high-priority patch target in enterprise and server environments.

Privilege escalation via use-after-free in the Windows DNS service exposes a broad range of Windows Server and Windows 10 systems to network-based attacks by unauthenticated adversaries. The race condition root cause (CWE-362) forces high attack complexity, as an attacker must win a precise timing window to corrupt freed memory and gain elevated privileges, reflected in the CVSS 8.1 score. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the full C/I/A impact across thirteen distinct product versions from Windows Server 2012 through Server 2025 warrants prompt patching.

Privilege escalation in Windows Telephony Service across a wide range of Microsoft Windows desktop and server editions enables a low-privileged local attacker to achieve SYSTEM-level control by exploiting a race condition in shared resource handling (CWE-362). The vulnerability spans Windows 10 through Windows 11 Version 25H2 and Windows Server 2012 through Server 2025, creating substantial attack surface despite the local access requirement. No public exploit identified at time of analysis; Microsoft has released patches resolving the flaw via the MSRC advisory for CVE-2026-62748.

Local privilege escalation via race condition in Windows Telephony Service affects a sweeping range of Microsoft Windows client and server editions, from Server 2012 through Windows 11 26H1. An authorized local attacker with low-privileged access can exploit improper synchronization over a shared resource to elevate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the vulnerable system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the breadth of affected Windows versions across enterprise environments makes unpatched exposure a meaningful operational risk.

Privilege escalation in Windows Telephony Service affects virtually every supported Windows desktop and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authorized local attacker exploits an improper synchronization flaw (CWE-362) in shared resource access within the telephony subsystem to elevate privileges to SYSTEM level, achieving full confidentiality, integrity, and availability impact. Microsoft has released patched builds; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.

Privilege escalation in the Windows Bind Filter Driver exposes Windows 11 systems across three active release tracks to full SYSTEM-level compromise by locally authenticated low-privilege users exploiting a kernel race condition. Rated CVSS 7.0 with high attack complexity, the vulnerability reflects a timing-dependent flaw in shared kernel resource access rather than a simple code injection. No public exploit identified at time of analysis, and the vulnerability is absent from CISA KEV; Microsoft has released patches for all confirmed affected builds.

Windows MIDI Service Module on Windows 11 contains a race condition enabling a locally authenticated low-privileged attacker to escalate privileges to a higher-integrity context, with full confidentiality, integrity, and availability impact upon success. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 below specific patch thresholds confirmed by ENISA EUVD-2026-56345. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity (AC:H) reflects the timing-dependent nature of race condition exploitation, moderating real-world risk relative to the CVSS base score of 7.0.

Local privilege escalation in Windows Push Notifications exposes a broad range of Microsoft Windows desktop and server editions to full SYSTEM-level compromise by an authenticated low-privileged local attacker. The flaw is a race condition (CWE-362) in which concurrent threads access a shared resource without adequate synchronization, creating a timing window that can be manipulated to corrupt execution state and redirect control to a privileged context. Microsoft has confirmed the issue and released patches across all affected Windows build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in the Windows Bind Filter Driver (bindflt.sys) permits a low-privileged local attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025 by exploiting a race condition that triggers a use-after-free in kernel memory. Affected builds span Windows 11 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations; Microsoft has released patched builds via the MSRC update guide. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Remote code execution via race condition in Windows DNS affects authorized, high-privileged attackers across a broad range of Windows Server and Windows client versions. The CWE-362 race condition allows an attacker who already holds elevated credentials to exploit concurrent shared-resource access in the DNS service, achieving full code execution (C:H/I:H/A:H) over the network. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released patches; the PR:H and AC:H constraints substantially limit realistic exploitation.

Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.

Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.

Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.

Privilege escalation in Windows Telephony Service via an improper synchronization race condition (CWE-362) allows a locally authenticated, low-privilege attacker to gain full control over an affected system, achieving high confidentiality, integrity, and availability impact. The flaw spans an exceptionally broad range of Windows releases - from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025 - and Microsoft has issued patched builds through the MSRC update guide. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Concurrent access to an unprotected singleton context structure in Zephyr RTOS's UpdateHub OTA subsystem enables two independent callers - the background autohandler and user-triggered update operations - to race through prepare_fds(), producing an out-of-bounds write that corrupts adjacent struct members and disables the firmware-update path. Affected are embedded systems running Zephyr with the UpdateHub subsystem enabled, particularly those built with CONFIG_USERSPACE where unprivileged userspace threads can invoke update syscalls and actively compete with the workqueue handler. No public exploit has been identified at time of analysis, the CVSS base score is 2.5, and the vendor commit confirms no demonstrated path to code execution - impact is limited to availability of the OTA update mechanism.

Denial-of-service in the TP-Link Archer A6 v4 httpd service allows an adjacent, authenticated attacker to crash the web management process or force a device reboot by exploiting a race condition in the asynchronous systool instruction handling path. All firmware builds prior to V4_1.15.10 Build 260625 Rel.25447 are affected; a vendor-released patch has been issued. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog - real-world risk is constrained by the adjacent network and high-privilege prerequisites.

Remote code execution is achievable in llama.cpp's LLaMA-Android JNI wrapper (builds b1886 through b7445) by exploiting a race condition use-after-free between `bench_1model()` and `free_1context()`, which share the `llama_context` heap object without any synchronization primitive. An attacker who wins the race can perform a heap spray with a crafted fake vtable, overwriting the vtable pointer at offset +0x30 in `llama_batch_allocr` so that `clear()` dispatches to attacker-controlled memory, achieving code execution within the Android application process. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the fully documented vtable offset and exploitation technique substantially lower the development barrier for capable researchers.

Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).

OS-level privilege escalation in Google Chrome's Windows CredentialProvider component allows a local attacker to gain elevated system privileges by winning a race condition triggered via a malicious file. Affected are all Chrome for Windows builds prior to 151.0.7922.109. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the SSVC assessment rates technical impact as total, meaning successful exploitation yields full system compromise.

Race condition in NVIDIA Dynamo's LoRA manager singleton initialization exposes Linux-based AI inference deployments running versions up to v1.2.0 to data tampering and denial of service. The flaw, classified under CWE-362, arises during concurrent initialization of the singleton responsible for managing Low-Rank Adaptation (LoRA) adapters, allowing competing threads or network-triggered requests to corrupt shared state before synchronization is established. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector paired with no privilege requirement makes this relevant for any internet-facing or multi-tenant Dynamo deployment.

Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.

Firmware update handling in Phoenix Contact CHARX SEC EV charging controllers (versions 1.0.0 through 1.8.x) exposes a race condition exploitable by unauthenticated remote attackers via the OCPP backend. By supplying an invalid firmware file, an attacker can cause the file to persist temporarily in accessible device storage during the flawed cleanup window before deletion, resulting in low-impact integrity interference with the firmware management process. No public exploit code and no CISA KEV entry have been identified; a vendor-released patch is confirmed at version 1.9.1.

Local privilege escalation in ASUS Armoury Crate lets a low-privileged local user execute arbitrary code with elevated privileges by winning a race condition (CWE-362) and substituting a crafted file during a time-of-check/time-of-use window. The flaw affects the Armoury Crate system-management/control software bundled on ASUS consumer and gaming hardware, and although CVSS 4.0 rates it 7.3 (High), exploitation is local-only and requires precise timing (AT:P). There is no public exploit identified at time of analysis and no CISA KEV listing.

Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.

Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in Google Chrome's V8 JavaScript engine (all versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though confined inside the renderer sandbox rather than achieving a full sandbox escape. Google rated the Chromium security severity as Low, and there is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation status: none). Exploitation hinges on winning a timing race, so despite the 7.5 CVSS score it is regarded as difficult to trigger reliably.

Sandbox escape in Google Chrome for macOS (versions before 151.0.7922.72) can be achieved by an attacker who has already compromised the renderer process, chaining a DevTools race condition via a crafted HTML page to break out of the renderer sandbox. Reported internally by the Chrome team and rated Medium by Chromium, it carries an NVD CVSS of 9.6 due to the scope change, though EPSS is very low (0.14%, 4th percentile). No public exploit identified at time of analysis and it is not on CISA KEV, indicating no confirmed active exploitation.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.

UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.

Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.

Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. There is no public exploit identified and EPSS is low (0.28%, 21st percentile), and CISA SSVC currently marks exploitation status as none.

Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. There is no public exploit identified at time of analysis, EPSS is low at 0.23%, and CISA SSVC records exploitation as 'none'.

Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Downloads component. Chromium rates it High severity and the CVSS is 9.6 (scope-changed). This is no public exploit identified at time of analysis; EPSS is low at 0.23% (14th percentile) and CISA SSVC records exploitation status as none.

Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.

Race condition in Xen's grant table version switching (v2 to v1) allows remote unauthenticated attackers to cause low confidentiality impact and denial of service under specific conditions. The vulnerability arises when hypervisor code drops and re-acquires the grant table lock during a version switch, creating a window where status frame properties can change inconsistently. No public exploit has been identified at time of analysis, and the CVSS network attack vector may be misleading as exploitation likely requires a guest domain to initiate the switch.

Race condition in Xen Grant Table version switching from v1 to v2 allows a malicious guest VM to cause low confidentiality impact and limited denial of service. The vulnerability occurs when hypervisor code drops and reacquires the grant table lock during the version transition, creating a window where reference counts become inconsistent. No active exploitation or public exploit code has been identified at time of analysis.

We are tasked to produce a comprehensive analysis JSON for CVE-2026-62432. We must synthesize all provided data: CVE description, CVSS, tags, SSVC, references, etc. The output must be plain-text strings per field, no arrays, no markdown. First, parse the input: - CVE ID: CVE-2026-62432 - Description: "The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer." - CVSS: 7.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) - Reported by: security@xen.org - Tags: Denial Of Service, Race Condition - SSVC: Exploitation: none, Automatable: yes, Technical Impact: partial - ENISA EUVD ID: EUVD-2026-49785 - References include xenbits advisory, NVD, oss-security. No listed KEV status, no POC mention, no explicit patch version. The patch data is missing (we need to check references? Not provided explicitly. We must infer from multiple sources. The description mentions xen and hypercall, so it's a Xen hypervisor vulnerability. We need to fill out each field. Let's systematically analyze. - product_name: From description, "EVTCHNOP_expand_array hypercall" implies Xen hypervisor. The vulnerability is in Xen's event channel mechanism. So product is "Xen Hypervisor". Could also say "Xen", but "Xen Hypervisor" is 2 words. According to rule "1-3 words ONLY", "Xen Hypervisor" fits. - summary: Must be 2-3 sentence plain-language synthesis. Not copy description. Start with impact verb and product. Example: "Race condition in Xen Hypervisor can lead to denial of service via NULL pointer dereference." But also mention what attacker can do. The CVSS suggests partial impacts in C/I/A, so maybe more than DoS? But tags say Denial Of Service, Race Condition, and description says dereferencing NULL pointer, so likely denial of service (sys

Information disclosure in Xen hypervisor's CMOS emulation allows a guest VM to exploit a race condition in the index caching mechanism, leading to an out-of-bounds read of hypervisor memory. A malicious guest can repeatedly manipulate the CMOS index port while the hypervisor processes an access, potentially leaking sensitive data from the host or other VMs. No active exploitation or public exploit code is known at this time.

Information disclosure in Xen's vNUMA configuration handling allows low-privileged authenticated attackers to read sensitive guest data during domain destruction. A race condition between the device model retrieving configuration and the simultaneous cleanup of that data permits unauthorized access to memory layout or other confidential information. No public exploit is identified, and the vulnerability is not known to be actively exploited at this time.

Heap out-of-bounds write in schreibfaul1's ESP32-audioI2S library version 3.4.5 stems from an unsynchronized AudioBuffer::freeSpace() calculation that concurrent FreeRTOS tasks can race, producing an inflated free-space value that callers trust when writing decoded audio. Successful exploitation corrupts heap memory on the ESP32 microcontroller, causing crashes and potentially arbitrary code execution. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity despite the 9.8 CVSS.

Kernel memory corruption via race condition in Apple OS allows a malicious app to write arbitrary kernel memory or cause unexpected system termination. The issue affects iOS, iPadOS, macOS, and watchOS versions prior to the June 2026 security fixes, and has been patched by Apple. No public exploit or active exploitation is known, and EPSS indicates a low probability of widespread exploitation at this time.

Unexpected system termination and kernel memory corruption in macOS allows remote attackers to fully compromise a machine. The race condition (CWE-362) is triggered without authentication or user interaction, and Apple has released fixes in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public exploit is confirmed, and EPSS indicates a low probability of real-world attacks.

A race condition in Apple operating systems (iOS, iPadOS, macOS, tvOS, watchOS) fixed in version 26.6 allows a local malicious app to cause unexpected system termination, resulting in a denial-of-service condition. No evidence of active exploitation or public exploit code exists, and EPSS indicates very low exploitation probability (0.16%). The NVD-assigned CVSS 9.8 appears inconsistent with the actual impact, which is limited to availability.

Local privilege escalation in macOS Sonoma 14.x before 14.8.8 and Sequoia 15.x before 15.7.8 allows a malicious app to gain elevated system privileges via a race condition. Apple has released patches, and no active exploitation or public proof-of-concept has been identified at this time.

Information disclosure in macOS and tvOS due to a race condition allows a malicious local app to read sensitive user data without authorization. Affected versions include macOS prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6, and tvOS prior to 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability.

Integrity modification in macOS Keychain allows remote unauthenticated attackers to modify Keychain state via a race condition. This vulnerability (CVE-2026-43728) is fixed in macOS Tahoe 26.6, with no known active exploitation but automatable according to SSVC. While CVSS rates it high severity, EPSS indicates very low likelihood of near-term exploitation.

iOS and iPadOS versions before 26.6 allow a malicious app to modify protected file system areas via a race condition. The vulnerability, tracked as CVE-2026-43811, requires local user interaction and has no known public exploit or active exploitation, with EPSS indicating very low real-world likelihood.

Local privilege escalation in Apple macOS allows a low-privileged application to gain root privileges by exploiting a race condition in system state management. The issue is resolved in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. No active exploitation has been reported, but the local attack vector limits remote risk.

Sensitive information disclosure vulnerability in macOS via a race condition allows a local malicious application to access user data. Apple fixed the issue in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public proof-of-concept is known.