CVE-2025-68957CWE-362

Multi-thread race condition vulnerability in the card framework module

High · published January 14, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
1.2
In the wild
Unconfirmed
What it is

⚡ A multi-thread race condition in the card framework module can leave your service hanging on the edge! Think of this like two delivery drivers trying to pick up the last package at the same time. If they don't coordinate, one might miss out entirely, causing delays in the entire operation. If exploited, this vulnerability can lead to significant downtime, meaning your users may not have access to critical features. It's a slippery slope toward service unavailability, which can affect your reputation and user trust.

Put simply

Think of this like two delivery drivers trying to pick up the last package at the same time. If they don't coordinate, one might miss out entirely, causing delays in the entire operation. This vulnerability arises from improper synchronization in the multi-threaded operations of the card framework module, allowing multiple threads to access shared resources at the same time, leading to unpredictable behavior.

What to do

If exploited, this vulnerability can lead to significant downtime, meaning your users may not have access to critical features. It's a slippery slope toward service unavailability, which can affect your reputation and user trust. To mitigate this, review and patch the card framework module to ensure proper thread synchronization. Additionally, conduct thorough testing to identify potential race conditions before they become a problem. You’ve got this! With a few tweaks, you can tighten up your application and keep everything running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00111 · 1.2th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-14T01:58Z
EPSS history
Timeline
  • 14 JAN 01:58Z
    Multi-thread race condition vulnerability in the card framework module
    cvelistv5