Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
We track 353 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 7 have been exploited in real attacks.
How this weakness is prevented
- Implementation: The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
- Implementation: When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
- Architecture and Design: Limit the interleaving of operations on files from multiple processes.
- Implementation Architecture and Design: If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
- Implementation: Recheck the resource after the use call to verify that the action was taken appropriately.
Latest Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities
- 7.0 High severity
rsync: Time-of-check Time-of-use (TOCTOU) Race Condition
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attacker
- 7.0 High severity
Fusion: Time-of-check Time-of-use (TOCTOU) Race Condition
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to roo
- 9.1 Critical severity
n8n-mcp: Time-of-check Time-of-use (TOCTOU) Race Condition
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger t
- 7.4 High severity
Guardicore Platform Agent: Time-of-check Time-of-use (TOCTOU) Race Condition
Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This ena
- 7.8 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: rust_binder: avoid reading the written value in offsets array When sending a transaction, its offsets array is first copied into the target proc's vma, and then the values are read back from t
- 8.1 High severity
Spring Cloud Config: Time-of-check Time-of-use (TOCTOU) Race Condition
The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclu
- 7.0 High severity
Sandboxie: Time-of-check Time-of-use (TOCTOU) Race Condition
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface,
- 8.1 High severity
PaperCut NG/MF: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data ch
- 7.8 High severity
Workspaces: Time-of-check Time-of-use (TOCTOU) Race Condition
Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations bypassing file
- 9.8 Critical severity
Automotive Grade Linux: Improper Limitation of a Pathname to a Restricted Directory
AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not
- 7.8 High severity
Linux: Concurrent Execution using Shared Resource with Improper Synchronization
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspace
- 7.8 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race w
- 7.0 High severity
coreutils: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the
- 8.8 High severity
PackageKit: Time-of-check Time-of-use (TOCTOU) Race Condition
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race
- 8.2 High severity
OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows sandbox escape. Attackers can exploit the separate path validation and file read operations to bypass sandbox restrictio
- 7.1 High severity
openproject: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no
- 7.0 High severity
Windows 10 Version 1607: Heap-based Buffer Overflow
Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Red Hat Enterprise Linux 10: Time-of-check Time-of-use (TOCTOU) Race Condition
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an
- 7.5 High severity
OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinned to a verified parent directory. Attackers can exploit a race condition in parent-path alias change
- 7.8 High severity
Xen: Time-of-check Time-of-use (TOCTOU) Race Condition
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not defe
- 7.0 High severity
OpenClaw: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between a
- 7.1 High severity
Intel(R) reference platforms may allow an…: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of pri
- 7.3 High severity
CODESYS Installer: Time-of-check Time-of-use (TOCTOU) Race Condition
If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCTOU vulnerability in the CODESYS installer.
- 7.0 High severity
Avira Internet Security: Time-of-check Time-of-use (TOCTOU) Race Condition
Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanu
- 8.5 High severity
Log Reporter: Time-of-check Time-of-use (TOCTOU) Race Condition
Intego Log Reporter, a macOS diagnostic utility bundled with Intego security products that collects system and application logs for support analysis, contains a local privilege escalation vulnerability. A root-executed diagnostic script creates and writes file
- 9.0 Critical severity
iOS and iPadOS: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A shortcut may be able to bypass
- 7.8 High severity
AMD Radeon™ RX 5000 Series Graphics Products: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global Memory Interconnect Trusted Agent (XGMI TA) commands as they are processed potentially resulting in loss of confidentiality,
- 7.8 High severity
AMD Radeon™ RX 5000 Series Graphics Products: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to corrupt memory resulting in loss of integrity, confidentiality, or availability.
- 7.5 High severity
clipbucket-v5: Time-of-check Time-of-use (TOCTOU) Race Condition
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to
- 9.0 Critical severity
SandboxJS: Time-of-check Time-of-use (TOCTOU) Race Condition
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property access
- 7.1 High severity
typescript-sdk: Concurrent Execution using Shared Resource with Improper Synchronization
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections,
- 9.9 Critical severity
n8n: Time-of-check Time-of-use (TOCTOU) Race Condition
n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. Thi
- 7.0 High severity
BuhoCleaner: Time-of-check Time-of-use (TOCTOU) Race Condition
BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2.
- 7.8 High severity
Native Access: Time-of-check Time-of-use (TOCTOU) Race Condition
It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler function uses
- 7.0 High severity
rufus: Time-of-check Time-of-use (TOCTOU) Race Condition
Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condition (TOCTOU) in src/net.c during the creation, validation, and execution of the Fido PowerShell script. Since Rufus runs with elevated privi
- 7.0 High severity
Windows 10 Version 1607: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Ec2007 Kernel: Time-of-check Time-of-use (TOCTOU) Race Condition
A local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The flaw is a Time-of-Check Time-of-Use (TOCTOU) race condition in the license management logic. The regService process, which runs with SYSTEM privileges, cre
- 7.4 High severity
nest: Time-of-check Time-of-use (TOCTOU) Race Condition
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `Midd
- 7.8 High severity
SASE Client for Windows: Execution with Unnecessary Privileges
Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file sy
- 7.5 High severity
Server Intrusion Protection: Time-of-check Time-of-use (TOCTOU) Race Condition
BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in after boot and before SIP MFA is running. The SIP services do not retroactively enforce MFA or disconnect