CVE-2025-68956CWE-362

Multi-thread race condition vulnerability in the card framework module

High · published January 14, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
1.2
In the wild
Unconfirmed
What it is

⚡ A sneaky multi-thread race condition could throw your system's availability into chaos! Think of this like two delivery trucks racing to the same address — if one arrives first and takes the last package, the other is left empty-handed, causing delays and confusion. Just as those trucks can't communicate effectively, threads in your system might clash, leading to unpredictable outcomes. If an attacker successfully exploits this vulnerability, it could potentially render your application unavailable, like a store shutting down right when customers are lined up at the door. This could lead to significant disruptions and loss of service, impacting your users and your business reputation.

Put simply

Think of this like two delivery trucks racing to the same address — if one arrives first and takes the last package, the other is left empty-handed, causing delays and confusion. Just as those trucks can't communicate effectively, threads in your system might clash, leading to unpredictable outcomes. This race condition in the card framework module occurs when multiple threads access shared resources without proper synchronization, resulting in unpredictable behavior and potential denial of service.

What to do

If an attacker successfully exploits this vulnerability, it could potentially render your application unavailable, like a store shutting down right when customers are lined up at the door. This could lead to significant disruptions and loss of service, impacting your users and your business reputation. To mitigate this vulnerability, promptly patch to the latest version provided by the vendor, which addresses the threading issues. Additionally, review your multi-threading practices to ensure proper synchronization mechanisms are in place, preventing similar vulnerabilities in the future. You've got this! With these steps, you’ll be well on your way to securing your application and keeping it running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00109 · 1.2th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-14T01:56Z
EPSS history
Timeline
  • 14 JAN 01:56Z
    Multi-thread race condition vulnerability in the card framework module
    cvelistv5