CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
535 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-34027 — Versa Concerto Authentication Bypass File Write Remote Code Execution
- CVE-2026-25641 — SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses
- CVE-2025-64180 — Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)
- CVE-2025-13032 — Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privela
- CVE-2024-41787 — IBM Engineering Requirements Management DOORS Next code execution
- CVE-2024-41779 — IBM Engineering Systems Design Rhapsody - Model Manager
- CVE-2026-79155 — Race condition in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the r
- CVE-2026-79071 — Race condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer
- CVE-2026-25052 — n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
- CVE-2026-25728 — ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition
- CVE-2026-87554 — Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute a
- CVE-2026-87457 — Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbi
- CVE-2026-79263 — Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code
- CVE-2026-79057 — Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social
- CVE-2026-65183 — Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
- CVE-2024-49768 — Waitress has request processing race condition in HTTP pipelining with invalid first request
- CVE-2024-0132 — NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with de
- CVE-2024-27114 — Remote Code Execution through File Upload in SOPlanning before 1.52.02
- CVE-2025-30663 — Zoom Workplace Apps - Time-of-check Time-of-use
- CVE-2024-23463 — Anti-Tampering bypass via Repair App functionality
Recently published
- CVE-2026-79968 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-79730 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains
- CVE-2026-87523 — Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engin
- CVE-2026-87457 — Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbi
- CVE-2026-87433 — Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rend
- CVE-2026-87554 — Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute a
- CVE-2026-87517 — Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social e
- CVE-2026-76925 — Flatpak: flatpak: toctou race condition allows symlink redirection
- CVE-2026-18567 — IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]
- CVE-2026-45197 — GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet
- CVE-2026-85045 — Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
- CVE-2026-78410 — Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
- CVE-2026-19118 — Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution
- CVE-2026-78319 — TOCTOU Vulnerability in file exchange
- CVE-2026-78422 — zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
- CVE-2026-19410 — Google Cloud Build Comment Control Bypass via Webhook Suppression
- CVE-2026-54754 — Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
- CVE-2026-82238 — filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads
- CVE-2026-77573 — Weblate: DNS rebinding in VCS operations allows server-side request forgery
- CVE-2026-58094 — TOCTOU race in POSIX shared memory large page configuration
More specific weaknesses
- CWE-363 — Race Condition Enabling Link Following