CWE-367Base3 in KEV

Time-of-check Time-of-use (TOCTOU) Race Condition

Incomplete in the CWE catalog · 534 CVEs mapped

534
CVEs mapped
3
In KEV
7.0
Median CVSS
What it is

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Recent examples
5.8cvss
CVE-2026-76925

CVE-2026-76925 - MEDIUM Severity Vulnerability

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.

MEDIUMno explanation yet
0%
epss
4.4cvss
CVE-2026-18567

CVE-2026-18567 - MEDIUM Severity Vulnerability

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.

MEDIUMno explanation yet
0%
epss
none
CVE-2026-45197

CVE-2026-45197 - UNKNOWN Severity Vulnerability

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.

no explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-367
Abstraction
Base
Structure
Simple
Status
Incomplete
References (2)