Weakness (CWE)
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
How to prevent it (7 mitigations)
-
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
-
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
-
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
-
Implementation, Architecture and Design
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
-
Implementation
Recheck the resource after the use call to verify that the action was taken appropriately.
-
Architecture and Design
Ensure that some environmental locking mechanism can be used to protect resources effectively.
-
Implementation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
Source: MITRE CWE-367
427 results · Clear filters · Feed
-
High 7.0
Windows TCP/IP Driver Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
-
High 7.3
Graphics Kernel Remote Code Execution Vulnerability
Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally.
-
High 7.8
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows NTFS Information Disclosure Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally.
-
High 7.8
Time-of-check Time-of-use race condition for some Intel(R) Connectivity Performance Suite software installers before ve…
-
High 7.2
Time-of-check time-of-use race condition in firmware for some Intel(R) Converged Security and Management Engine may all…
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Display
Memory corruption while processing simultaneous requests via escape path.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux
Memory corruption when using Virtual cdm (Camera Data Mover) to write registers.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera_Linux
Memory corruption while submitting blob data to kernel space though IOCTL.
-
High 8.1
Race condition vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affec…
-
High 7.0
NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to es…
-
High 7.8
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …
KEV Sep 4, 2025 -
High 7.8CVE-2025-49730 Public exploit
Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.
-
High 8.4CVE-2025-3464 Public exploit
A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issu…
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service
Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
-
High 7.6
Containerd vulnerable to host filesystem access during image unpack
containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only …
-
High 8.8
Zoom Workplace Apps - Time-of-check Time-of-use
Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.
-
High 7.5
Time-of-check time-of-use race condition in the UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50…
-
High 7.7
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Virtual Machine Bus allows an unauthorized attacker to execute code locally.
-
High 7.5CVE-2025-29969 Public exploit
MS-EVEN RPC Remote Code Execution Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.
-
High 7.5
TOCTOU in SmmWhea
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.
-
High 7.8
Avast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation Vulnerability
Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbo…
-
High 7.8
Link Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4
Link Following Local Privilege Escalation Vulnerability in TuneUp Service in AVG TuneUp Version 23.4 (build 15592) on Windows 10 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and…
-
High 7.8
Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)
Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the …
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption when blob structure is modified by user-space after kernel verification.
-
High 7.5
conda-forge-webservices has an Unauthorized Artifact Modification Race Condition
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastruct…
-
High 8.1
-
High 7.0
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera
Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.
-
High 7.5
SMM Arbitrary Write via TOCTOU Vulnerability
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.
-
High 8.6
QVPN Device Client, Qsync, Qfinder Pro
A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources.…
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform
Memory corruption may occur in keyboard virtual device due to guest VM interaction.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle Networks
Memory corruption may occur while processing message from frontend during allocation.
-
High 7.5
Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 m…
-
High 8.3
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default c…
-
High 7.0
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
-
High 7.8
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, whic…
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera
Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.