Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
We track 353 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 7 have been exploited in real attacks.
How this weakness is prevented
- Implementation: The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
- Implementation: When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
- Architecture and Design: Limit the interleaving of operations on files from multiple processes.
- Implementation Architecture and Design: If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
- Implementation: Recheck the resource after the use call to verify that the action was taken appropriately.
Latest Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities
- 7.5 High severity
n8n: Time-of-check Time-of-use (TOCTOU) Race Condition
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs.
- 7.8 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lock_dwork draining on unmap Given how rbd_lock_add_request() and rbd_img_exclusive_lock() are written, lock_dwork may be (re)queued more than it's actually needed: fo
- 9.8 Critical severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct si
- 9.3 Critical severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_ha
- 8.8 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU
- 8.2 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS
- 7.1 High severity
OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and
- 7.0 High severity
Zoom Clients: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.
- 8.1 High severity
better-auth: Concurrent Execution using Shared Resource with Improper Synchronization
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-t
- 8.1 High severity
better-auth: Concurrent Execution using Shared Resource with Improper Synchronization
Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on
- 7.5 High severity
diffusers: Time-of-check Time-of-use (TOCTOU) Race Condition
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading fr
- 7.8 High severity
Creative Cloud Desktop: Time-of-check Time-of-use (TOCTOU) Race Condition
Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation
- 7.1 High severity
OpenClaw: Improper Link Resolution Before File Access
OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and
- 7.8 High severity
Graphics DDK: Time-of-check Time-of-use (TOCTOU) Race Condition
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memo
- 7.4 High severity
9router: Time-of-check Time-of-use (TOCTOU) Race Condition
9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated att
- 9.4 Critical severity
varstored: Time-of-check Time-of-use (TOCTOU) Race Condition
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issue
- 8.5 High severity
Container Toolkit: Time-of-check Time-of-use (TOCTOU) Race Condition
NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering.
- 7.1 High severity
budibase: Time-of-check Time-of-use (TOCTOU) Race Condition
Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is
- 7.8 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata area resides in the UMEM buffer which is memory-mapped and concurrently writable by userspace. In xsk_skb_
- 7.8 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure
- 7.8 High severity
Linux: Concurrent Execution using Shared Resource with Improper Synchronization
In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_fil
- 7.0 High severity
qSnapper: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers authentication mechanism and operate e.g. as root user.
- 7.8 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-ow
- 9.8 Critical severity
OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, po
- 8.1 High severity
OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved
- 8.8 High severity
OpenClaw: Improper Neutralization of Special Elements used in a Command
OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypass
- 7.2 High severity
moby: UNIX Symbolic Link (Symlink) Following
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirec
- 7.4 High severity
Apache CXF: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed
- 8.8 High severity
OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers can exploit this by using combined shell options to execute inline shell content without intended allow
- 8.4 High severity
Slate Digital Connect: Time-of-check Time-of-use (TOCTOU) Race Condition
Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining
- 7.0 High severity
Windows 10 Version 21H2: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (TOCTOU) race condition in Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
- 8.1 High severity
Waves Central: Time-of-check Time-of-use (TOCTOU) Race Condition
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. B
- 7.3 High severity
X-VPN macOS website: Time-of-check Time-of-use (TOCTOU) Race Condition
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.
- 7.3 High severity
SWUpdate: Time-of-check Time-of-use (TOCTOU) Race Condition
SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.
- 7.4 High severity
PS4: Time-of-check Time-of-use (TOCTOU) Race Condition
A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through a malformed JAR file.
- 7.8 High severity
Linux: Use After Free
In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entr
- 7.8 High severity
GeForce: Time-of-check Time-of-use (TOCTOU) Race Condition
NVIDIA Display Driver for Windows contains a vulnerability where an attacker could cause a time-of-check time-of-use issue. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampe
- 7.8 High severity
TrendAI Apex One: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in ord
- 7.8 High severity
TrendAI Apex One (Mac): Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged co
- 7.0 High severity
TrendAI Apex One (Mac): Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to exec