Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
We track 353 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 7 have been exploited in real attacks.
How this weakness is prevented
- Implementation: The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
- Implementation: When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
- Architecture and Design: Limit the interleaving of operations on files from multiple processes.
- Implementation Architecture and Design: If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
- Implementation: Recheck the resource after the use call to verify that the action was taken appropriately.
Latest Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities
- 7.0 High severity
Pardus Package Installer: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus Package Ins
- 8.1 High severity
zipline: Time-of-check Time-of-use (TOCTOU) Race Condition
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneou
- 7.0 High severity
Display and Peripheral Manager (DDPM Windows): Time-of-check Time-of-use (TOCTOU) Race Condition
Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code exec
- 7.8 High severity
Android: Time-of-check Time-of-use (TOCTOU) Race Condition
In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.
- 7.0 High severity
Windows 10 Version 1809: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1809: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- 8.5 High severity
Intel(R) VTune(TM) Profiler software: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low com
- 8.5 High severity
Intel(R) VTune(TM) Profiler software: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enabl
- 7.2 High severity
cocos: Time-of-check Time-of-use (TOCTOU) Race Condition
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached
- 9.1 Critical severity
kyverno: Time-of-check Time-of-use (TOCTOU) Race Condition
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attesta
- 7.7 High severity
APT: UNIX Hard Link
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installi
- 7.0 High severity
zephyr: Time-of-check Time-of-use (TOCTOU) Race Condition
The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the caller-supplied struct i3c_device_desc in place instead of snapshotting it. It confirmed only that the descriptor was read
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 7.7 High severity
claude-code: Improper Link Resolution Before File Access
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandb
- 8.1 High severity
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Exploited
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the se
- 7.8 High severity
Full Client: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer packa
- 8.8 High severity
boneIO: Time-of-check Time-of-use (TOCTOU) Race Condition
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileg
- 7.2 High severity
PraisonAI: Time-of-check Time-of-use (TOCTOU) Race Condition
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medi
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Mediu
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted PDF file. (Chromium security severity: L
- 9.6 Critical severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security seve
- 8.1 High severity
Apache Tomcat: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NI
- 7.5 High severity
QuRouter: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the follow
- 8.8 High severity
Red Hat Enterprise Linux 10: Time-of-check Time-of-use (TOCTOU) Race Condition
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
- 7.0 High severity
util-linux: Time-of-check Time-of-use (TOCTOU) Race Condition
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before
- 7.0 High severity
util-linux: Time-of-check Time-of-use (TOCTOU) Race Condition
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount t
- 7.0 High severity
Windows 10 Version 1607: Heap-based Buffer Overflow
Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.