By weakness (CWE)

CWE-362: related vulnerabilities

CVEs classified under CWE-362. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

65 published vulnerabilities

• CVE-2026-44693HIGH 8.8

  Pi-hole FTL, the network-level ad and tracker blocking engine, contains a race condition in its HTTP session management system that was introduced when the project rewrote its web server component in version 6.0. This flaw allows an attacker to exploit timing windows in session handling to gain unauthorized access or manipulate user sessions. The vulnerability requires user interaction (such as clicking a malicious link) but can result in full compromise of the Pi-hole administrator interface. The issue is resolved in version 6.6.1.

• CVE-2026-10940HIGH 8.3

  A race condition vulnerability in Chrome's media codec handling allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox on Windows systems. The attacker would need to trick a user into visiting a specially crafted website, but once the renderer is compromised, this flaw could give the attacker full system-level access. Chrome versions before 149.0.7827.53 on Windows are affected.

• CVE-2026-11677HIGH 8.3

  A race condition vulnerability in Google Chrome's network process on macOS allows an attacker who has already compromised the browser's network process to escape the sandbox and potentially gain system-level access. The vulnerability requires the attacker to craft a malicious HTML page and trick a user into viewing it, but the underlying network process compromise is the critical prerequisite. This is a privilege escalation vector rather than a primary infection method.

• CVE-2026-12022HIGH 8.3

  A race condition in Google Chrome's Safe Browsing feature on macOS allows an attacker who has already compromised the browser's renderer process to escape the sandbox using a specially crafted file. This means an attacker would need to first gain code execution within Chrome itself, then exploit this timing vulnerability to break out of Chrome's security boundary and gain full system access. The vulnerability affects Chrome versions prior to 149.0.7827.115 on Mac.

• CVE-2026-12454HIGH 8.3

  CVE-2026-12454 is a race condition flaw in Google Chrome's Safe Browsing feature on macOS that allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox and gain access to the underlying system. The vulnerability requires a specially crafted HTML page and user interaction, but once triggered, it can lead to complete system compromise. This is a high-severity issue because successful exploitation means an attacker can move from browser isolation into full OS-level execution.

• CVE-2026-12468HIGH 8.3

  A race condition in Chrome's auto-update mechanism on macOS allows an attacker who has already compromised the browser's rendering engine to escape the sandbox and gain full system privileges. The vulnerability requires the attacker to first breach the renderer process (a less privileged part of Chrome) through a malicious web page, then exploit a timing flaw in the updater to break out of Chrome's security isolation. This is a chained attack: the initial compromise is necessary, but once achieved, the sandbox escape becomes a critical escalation path. Chrome versions before 149.0.7827.155 on macOS are affected.

• CVE-2026-15119HIGH 8.3

  A race condition exists in Google Chrome's GetUserMedia function that could allow an attacker to escape the browser's sandbox if they have already compromised the renderer process. The vulnerability requires user interaction and only affects Chrome versions before 150.0.7871.115. While this is a high-severity flaw, it requires a multi-step attack chain where the attacker must first gain code execution within the renderer before attempting the sandbox escape.

• CVE-2026-5120HIGH 8.1

  BIOVIA Workbook contains a race condition—a timing-based flaw where two operations can interfere with each other—that allows an authenticated user to view data belonging to another user. The vulnerability affects all versions from Release 2021 through Release 2026. Because an attacker needs valid login credentials, the risk is primarily from insiders or compromised accounts within your organization. The flaw does not allow data modification or system disruption, only unauthorized viewing.

• CVE-2026-42487HIGH 7.9

  This is a race condition vulnerability in Xen's handling of guest virtual machine I/O port access. When a guest operating system attempts to access hardware I/O ports, Xen's device model manages how those accesses are translated or emulated. The problem: the internal list tracking these translations can be modified while another part of Xen is reading it, creating a window where the system reads inconsistent or stale information. This can lead to unexpected behavior, data corruption, or system crashes. A local attacker with guest-level privileges could exploit this to affect the stability or integrity of the hypervisor or other guest systems sharing the same host.

• CVE-2026-0068HIGH 7.8

  A flaw in Android's PackageInstallerService allows an attacker to uninstall a Device Policy Controller (DPC) app—security software that enforces organizational policies on managed devices—without the Device Owner's knowledge or consent. The vulnerability stems from a synchronization gap between runtime state and persistent storage. An attacker would need to trick a user into installing a malicious app, after which the flaw could be exploited to remove critical management controls. This is particularly dangerous in corporate environments where DPC apps enforce compliance, security policies, and data protection.

• CVE-2026-42977HIGH 7.8

  A race condition in Windows Push Notifications allows an authorized user on a Windows machine to exploit a timing gap and gain elevated system privileges. An attacker who already has basic user access can trigger this vulnerability locally without needing to interact with the system at a particular moment—the flaw is entirely automated once initiated. This affects multiple versions of Windows 10, Windows 11, and Windows Server.

• CVE-2026-42978HIGH 7.8

  CVE-2026-42978 is a privilege escalation vulnerability in Windows Push Notifications that affects multiple versions of Windows 10, Windows 11, and Windows Server. An authenticated attacker with local access can exploit a race condition—a timing-based flaw where concurrent operations on a shared resource lack proper synchronization—to gain elevated system privileges. This is a local attack requiring an existing user account, but the consequences are severe: an attacker could gain administrative control of the affected system. The vulnerability is not currently being exploited in the wild according to public disclosures.

• CVE-2026-42979HIGH 7.8

  A race condition in Windows Push Notifications allows an attacker who already has local access to a computer to gain higher-level privileges. The vulnerability exploits a timing gap in how the notification system handles shared resources, enabling privilege escalation. This is a local attack that requires an authorized user account to initiate, but could allow an attacker to break out of restricted accounts and gain administrative control.

• CVE-2026-42991HIGH 7.8

  CVE-2026-42991 is a race condition in Windows Push Notifications that allows an authorized local user to escalate their privileges to a higher level of access. The vulnerability requires an attacker who already has login credentials and cannot be exploited remotely. It affects multiple versions of Windows 10, Windows 11, and Windows Server. While the barrier to exploitation is moderate due to timing constraints, the impact is severe—an attacker could gain system-level control.

• CVE-2026-46157HIGH 7.8

  A concurrency bug exists in the Linux kernel's ALSA (Advanced Linux Sound Architecture) OSS (Open Sound System) compatibility layer. When multiple processes try to access and modify the trigger control bit simultaneously, the kernel lacks proper synchronization, allowing writes to corrupt not just the intended trigger flag but adjacent bit fields in memory. This confusion can destabilize audio subsystem behavior. The vulnerability requires local access and privileges to trigger.

• CVE-2026-46275HIGH 7.8

  A series of use-after-free and race condition bugs exist in the Linux kernel's Bluetooth HCI UART driver lifecycle management. The vulnerabilities occur when the driver tears down connections or encounters initialization failures. In particular, if a device disconnects before setup completes, or if multiple operations race during shutdown, the driver may attempt to access memory that has already been freed. This can lead to crashes or potentially allow local code execution. The root cause involves improper ordering of cleanup steps and inadequate synchronization between concurrent workqueues and teardown sequences.

• CVE-2026-52991HIGH 7.8

  CVE-2026-52991 is a use-after-free vulnerability in the Linux kernel's process scheduler and cgroup subsystem. The flaw occurs when a process tries to write pressure metrics to a cgroup control file at the same moment the cgroup is being deleted on another CPU. This timing collision can cause the kernel to access memory that has already been freed, potentially leading to system crashes or privilege escalation. The vulnerability requires local access and does not require special permissions, making it a meaningful threat in multi-tenant or shared-system environments.

• CVE-2026-53020HIGH 7.8

  A race condition exists in the Linux kernel's TLB (Translation Lookaside Buffer) synchronization logic. When the kernel synchronizes TLB entries across multiple processors, it traverses and modifies page table structures without consistently holding the necessary locks. This can allow a local attacker with user-level privileges to manipulate memory access patterns in ways that corrupt kernel data structures or gain unauthorized access to sensitive information. The vulnerability stems from incomplete synchronization mechanisms in the kernel's multi-core support for shared address spaces.

• CVE-2026-53050HIGH 7.8

  A race condition exists in the Linux kernel's quota management system where two parallel operations can interfere with each other. When the quota deactivation process and the active quota scanner run simultaneously, the scanner may obtain a reference to a quota object that is being freed, potentially leading to use-after-free conditions. This vulnerability requires local access and valid user privileges to exploit, but once triggered can cause system crashes or data corruption under memory pressure.

• CVE-2026-10006HIGH 7.5

  A race condition in Google Chrome's WebAudio component allows attackers to execute arbitrary code within the browser sandbox by serving a specially crafted HTML page to a user. The vulnerability requires user interaction (clicking or navigating to the malicious page) but does not require special privileges. Successfully exploiting this issue could allow an attacker to run code with the permissions of the Chrome process, potentially leading to data theft, malware installation, or further system compromise.

• CVE-2026-1220HIGH 7.5

  A race condition in Google Chrome's V8 JavaScript engine could allow an attacker to trick the browser into confusing data types when processing a malicious webpage. An attacker would need to craft a specific HTML page and convince a user to visit it, but if successful, the vulnerability could lead to information disclosure, data tampering, or application crashes. Chrome versions before 144.0.7559.99 are affected.

• CVE-2026-42909HIGH 7.5

  A race condition flaw in Microsoft's Remote Desktop Client and related Windows components allows an attacker to execute malicious code on a target machine over the network. The vulnerability requires the user to interact with a malicious connection or file, but once triggered, grants the attacker the same privileges as the logged-in user. This affects multiple versions of Windows 10, Windows 11, Windows Server, and the standalone Windows App, making it a broad-reaching concern across enterprise environments.

• CVE-2026-42913HIGH 7.5

  A race condition flaw in Remote Desktop Client allows an attacker to execute arbitrary code on a Windows system by exploiting a window between when two processes access shared resources without proper locking. The attack requires network access and user interaction (such as establishing an RDP session), but successfully exploiting it grants full code execution with the privileges of the Remote Desktop Client process. This affects multiple Windows 11 versions and Windows Server 2022/2025.

• CVE-2026-48708HIGH 7.5

  OliveTin is a web-based interface for executing predefined shell commands. A race condition in versions up to 3000.0.0 allows concurrent command executions to interfere with each other. When multiple users run actions simultaneously—which happens by default—the template engine that constructs these commands can be corrupted mid-execution, leading to commands being swapped between users, application crashes, or commands running with unintended parameters. This issue is fixed in version 3000.13.0.

• CVE-2026-48505HIGH 7.4

  Filament, a Laravel development toolkit, contains a flaw in its app-based multi-factor authentication (MFA) recovery code system that allows a single recovery code to be used multiple times if an attacker submits it rapidly in parallel. Normally, recovery codes are single-use—meant to be burned after one authentication attempt. An attacker who has stolen both a user's password and recovery codes could exploit this concurrency issue to create multiple authenticated sessions from a single code, significantly extending their unauthorized access window. This only affects app-based MFA with recovery codes enabled; email-based MFA is not vulnerable. Versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 are affected.

• CVE-2022-26758HIGH 7.1

  CVE-2022-26758 is a memory corruption vulnerability in macOS that allows a malicious application running on the same system to alter memory regions shared between processes. An attacker with local access and the ability to execute code would be able to read sensitive data or modify system behavior by corrupting this shared memory. Apple resolved this through improved state management in macOS Monterey 12.4.

• CVE-2026-0083HIGH 7.0

  A race condition in Android's NFC (Near Field Communication) event handling code allows a local attacker with basic system access to escalate their privileges to access sensitive data or modify system files. The vulnerability requires precise timing exploitation but no special permissions or user interaction to trigger, making it a significant local security concern.

• CVE-2026-42836HIGH 7.0

  A race condition in Windows' Function Discovery Service (fdwsd.dll) allows a user already logged into a machine to escalate their privileges to administrator level. The vulnerability exists because the service does not properly synchronize access to shared resources when multiple processes run concurrently, creating a narrow window where an attacker can manipulate the process. An authorized user would need local access and specific timing to exploit this, but successful exploitation grants full system-level permissions.

• CVE-2026-42912HIGH 7.0

  A race condition in Windows Telephony Service allows an attacker who already has local user access to exploit improper synchronization of shared resources and gain system-level privileges. The vulnerability requires the attacker to perform specific timing-dependent actions during concurrent operations—making it moderately difficult to exploit in practice, but reliably escalatable once triggered. No user interaction is required beyond the attacker's ability to run code as a local user.

• CVE-2026-44818HIGH 7.0

  A race condition vulnerability in Microsoft Office Excel could allow an attacker to execute code on a user's computer. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker would need to trick a user into opening a malicious Excel file, but once triggered, the vulnerability can grant full control over the affected system. The vulnerability affects multiple versions of Excel and Office across 365 subscriptions, on-premises deployments, and older perpetual licenses.

• CVE-2026-45596HIGH 7.0

  A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) allows an authenticated attacker to elevate their privileges on a local system. The vulnerability requires the attacker to already have user-level access and involves a race condition during memory management. Successfully exploiting it grants the attacker full system-level control.

• CVE-2026-45597HIGH 7.0

  A race condition vulnerability in Windows UI Automation Manager allows an authorized local user to escalate privileges on affected systems. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker with existing local access can exploit timing windows to gain system-level privileges. This is not a remote vulnerability and requires prior authentication or local access, which narrows but does not eliminate the risk in shared computing environments.

• CVE-2026-45598HIGH 7.0

  A race condition in Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an attacker who already has local access to a system to escalate their privileges to a higher level. The vulnerability stems from improper synchronization when the driver handles shared resources, meaning that under specific timing conditions, an attacker can exploit the flaw to gain elevated permissions. This is not a remote attack—the attacker must already have a foothold on the machine, such as a low-privileged user account or compromised application context.

• CVE-2026-45601HIGH 7.0

  A race condition in the Windows Ancillary Function Driver for WinSock allows someone already logged into a Windows system to escalate their privileges to a higher level of access. The vulnerability arises from improper synchronization of shared resources, meaning two processes can interfere with each other when accessing the same data simultaneously. An attacker with local user privileges can exploit this timing-dependent flaw to gain elevated system rights, though doing so requires specific conditions and is not trivial to reproduce reliably.

• CVE-2026-45603HIGH 7.0

  A race condition vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD) that allows an authorized local user to escalate privileges to a higher level on the system. The flaw arises from improper synchronization when multiple processes access a shared resource simultaneously, creating a narrow window of opportunity for an attacker to manipulate the driver's behavior. An authenticated user with basic local access can exploit this to gain elevated privileges, potentially achieving full system compromise. This is not a remote vulnerability and requires the attacker already has some level of access to the target machine.

• CVE-2026-54229HIGH 7.0

  A timing vulnerability exists in the abrt-dbus D-Bus service that allows a local attacker with limited privileges to take control of crash dump files while the system is processing them. The vulnerability stems from a race condition where the ChownProblemDir method changes file ownership even though privileged event handlers are actively writing to the same directory. An attacker exploiting this can redirect, modify, or delete crash dumps before they're fully processed, potentially compromising system integrity and enabling local privilege escalation.

• CVE-2026-56297HIGH 7.0

  FreeRDP versions before 3.22.0 contain a flaw that allows a malicious RDP server to crash or potentially take control of the client machine. The vulnerability involves a race condition—a timing problem where two network messages arrive in quick succession and cause the software to use memory that has already been freed. An attacker running a malicious RDP server can exploit this by sending specially timed messages to trigger the condition, resulting in either denial of service or remote code execution.

• CVE-2026-46732MEDIUM 6.7

  Dell Display and Peripheral Manager (DDPM) for macOS versions before 2.3 contain a race condition vulnerability that allows a low-privileged local user to escalate their privileges on an affected system. A race condition occurs when a program accesses a shared resource in an unsafe manner, allowing an attacker to manipulate the timing or sequence of operations to gain unauthorized access. In this case, the vulnerability requires the attacker to already have local access to the system and user interaction to be exploited, which somewhat limits its attack surface but still represents a meaningful privilege escalation risk.

• CVE-2026-14015MEDIUM 6.5

  A race condition in Google Chrome's WebRTC implementation on Windows allows an attacker to trick users into visiting a malicious webpage that leaks data across security boundaries. The vulnerability is triggered during a timing-sensitive sequence in the WebRTC audio/video processing stack, where data meant to be isolated between different website origins becomes accessible. An attacker would need user interaction—specifically, the victim must visit the crafted HTML page—but once there, sensitive information from other websites could be exposed without further prompting.

• CVE-2026-14082MEDIUM 6.5

  A race condition in Google Chrome's storage subsystem allows attackers to access sensitive data across different websites through a specially crafted HTML page. The vulnerability requires user interaction—such as visiting a malicious webpage—but doesn't need special privileges or browser configuration to exploit. While Chromium's own severity rating is 'Low,' the confidentiality impact warrants a medium-severity classification due to the potential exposure of cross-origin data that should otherwise be isolated by browser security boundaries.

• CVE-2026-59896MEDIUM 6.5

  Hono is a popular JavaScript web framework used across multiple runtime environments. A vulnerability in its JSX rendering component (versions 4.11.8 through 4.12.26) fails to properly isolate context data between concurrent requests during server-side rendering. This means that when an async component uses `await`, it could accidentally access context values—such as user data, request headers, or other sensitive information—from a different user's request that was processed at the same time. An attacker doesn't need special privileges or user interaction to trigger this; the vulnerability manifests when multiple requests are handled in parallel, creating a window where context bleeding occurs.

• CVE-2026-9831MEDIUM 6.3

  A timing vulnerability in Extreme Platform ONE's identity and access management (IAM) gateway could occasionally allow an authenticated user to view data belonging to a different customer organization. The issue occurs only under specific high-traffic conditions where concurrent API requests overlap, and only affects API-key-based authentication—not Extreme's newer token or OAuth methods. An attacker would need valid API credentials to attempt this, and success is not guaranteed; the flaw is triggered by race conditions in how the gateway validates which tenant's data should be returned.

• CVE-2026-54778MEDIUM 6.2

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a concurrency flaw in how it resolves user identities for Unix domain socket connections. The vulnerability stems from the use of non-thread-safe system functions (getpwuid and getgrgid) that can cause one client connection to be misidentified as another during simultaneous access, or potentially crash the service. Versions prior to 1.8.1 and 1.9.1 are affected. This is a local attack surface issue affecting systems where CoreWCF processes handle multiple concurrent Unix socket clients.

• CVE-2026-47741MEDIUM 5.9

  Shopper, a headless e-commerce admin panel, had a race condition in its checkout process that allowed customers to bypass discount usage limits during high-concurrency periods like Black Friday or flash sales. The system would apply a discount to an order and save it to the database before verifying whether that discount had already been used up. If multiple customers checked out simultaneously with the same coupon, the system would grant the discount to all of them even after the coupon's limit was exceeded, because the counter-increment happened too late in the process. Merchants would not receive any warning that over-redemption had occurred, leading to undetected revenue loss.

• CVE-2026-57030MEDIUM 5.9

  Juniper SRX Series firewalls contain a race condition in their packet forwarding engine that can be exploited by sending specially crafted network traffic to cause denial of service. The bug occurs during flow session cleanup—normally flows are removed after 3 seconds of inactivity, but a timing issue can cause the timeout to be set to over 10,000 seconds instead. This prevents flows from being cleaned up properly, causing session tables to accumulate stale entries until the device either stops forwarding traffic entirely or crashes and reboots.

• CVE-2026-48982MEDIUM 5.8

  pam_usb is a Linux authentication system that uses removable media (like USB devices) as a hardware security token. The vulnerability exists in how pam_usb creates temporary files when updating its one-time pad—a counter that prevents the same authentication credential from being reused. The flaw: the temporary file is created without atomic guarantees, meaning two processes updating the pad simultaneously could both write to the file, with the second write erasing the first. This race condition could cause authentication failures or, in a worst-case scenario, create a window where an attacker could replay a previously-used credential. The issue is resolved in version 0.9.2.

• CVE-2025-15546MEDIUM 5.4

  The Iptanus File Upload WordPress plugin versions before 5.1.7 contain a race condition vulnerability that allows authenticated users to overwrite files uploaded by other users when the "maintain both" duplicate file policy is enabled. An attacker must be logged in and the victim must actively upload a file at nearly the same moment the attacker attempts their action, making exploitation difficult but possible in environments with concurrent file uploads.

• CVE-2026-11145MEDIUM 5.3

  A race condition in Google Chrome's geolocation feature on Android devices allows attackers to steal sensitive information across website boundaries. By crafting a malicious webpage, an attacker can exploit a timing vulnerability to extract data from other origins—websites or apps—that the user has visited or is logged into. The vulnerability requires user interaction (visiting the malicious page) and specific technical conditions to trigger, but successful exploitation could expose authentication tokens, personal information, or other confidential data from legitimate services.

• CVE-2026-13874MEDIUM 5.3

  A race condition exists in Google Chrome's DataTransfer mechanism that allows attackers to leak sensitive information from process memory. An attacker can craft a malicious HTML page that, when visited by a user, exploits timing vulnerabilities to read data that should be protected. While the attack requires user interaction (visiting a malicious website) and careful timing, the potential exposure of process memory contents makes this a meaningful privacy risk.

• CVE-2026-43743MEDIUM 4.7

  CVE-2026-43743 is a race condition affecting Apple's operating systems that can cause an application to unexpectedly crash or terminate the system. The vulnerability requires an attacker to already have code execution on the device (local access) and involves a timing-sensitive flaw in how the operating system handles concurrent operations. While the impact is limited to availability—the system can be made to crash—the fix is straightforward through standard OS updates.

• CVE-2026-46187MEDIUM 4.7

  The Linux kernel's RSI wireless driver has a race condition in how it shuts down worker threads. The driver uses two different methods to stop these threads: a self-terminating approach and an external stop command. When the self-terminating method completes first and then the external stop is called, the code tries to access a thread that has already been freed from memory—a use-after-free vulnerability. This affects local users with moderate privileges and can cause a system crash or unexpected behavior.

• CVE-2026-46272MEDIUM 4.7

  CVE-2026-46272 is a race condition in the Linux kernel's CoreSight Trace Memory Controller (TMC) Embedded Trace Receiver (ETR) driver. When a system attempts to run both performance tracing (perf) and sysfs-based hardware tracing simultaneously, a timing gap between buffer allocation and hardware enablement in sysfs mode allows the perf mode to initialize its own buffer state. This causes sysfs mode to later detect the unexpected state and trigger a kernel warning, resulting in denial of service through system instability. The vulnerability exists because the sysfs enablement process was split across two separate locking regions, creating a window where perf mode could intervene.

• CVE-2026-46298MEDIUM 4.7

  A race condition exists in the Linux kernel's PAPR HVPIPE driver that can cause a system deadlock. The vulnerability occurs when an interrupt fires on the same CPU while the driver's ioctl or release handlers are executing. If both try to acquire the same lock simultaneously, the system can become unresponsive. The issue is resolved by using interrupt-safe lock primitives that prevent interrupts from firing during critical sections, eliminating the deadlock scenario. This is primarily a local denial of service affecting systems running vulnerable kernel versions.

• CVE-2026-53008MEDIUM 4.7

  A race condition exists in the Linux kernel's ice driver that can cause a system crash when one CPU is cleaning up TX timestamp resources while another CPU is actively using them. The vulnerability occurs because pointer cleanup and flag clearing happen in the wrong order, allowing a concurrent operation to dereference a NULL pointer. The impact is limited to systems with the ice driver loaded and TX timestamping enabled, and requires local access to trigger.

• CVE-2026-53108MEDIUM 4.7

  A race condition exists in the Linux kernel's memory management on PowerPC 64-bit systems that can trigger a kernel crash (panic) when two processes simultaneously attempt incompatible operations on the same memory pages. Specifically, when one process moves memory pages between NUMA nodes using move_pages() while another process unmaps that memory via munmap(), the kernel can encounter an assertion failure. The vulnerability requires local access and moderate effort to trigger, but results in a denial of service affecting system availability.

• CVE-2026-53352MEDIUM 4.7

  CVE-2026-53352 is a race condition in the Linux kernel's signal handling code. When a multi-threaded process receives a stop signal and one thread calls execve() simultaneously, the kernel fails to properly clean up job control flags on the calling thread. This leaves stale signal state that causes the thread to attempt an invalid operation when returning to user mode, triggering a kernel warning. The vulnerability requires local access and specific timing, but can crash or destabilize the kernel.

• CVE-2026-13502MEDIUM 4.5

  A timing vulnerability has been discovered in ANTLR4's Maven plugin (versions up to 4.13.2) that could allow a local attacker to manipulate file operations during the deserialization process. The flaw exploits a race condition between checking and using files, potentially leading to unauthorized access to sensitive data or modification of build artifacts. Exploitation requires local system access, elevated privileges, and significant technical skill, making it a targeted rather than widespread risk.

• CVE-2026-11253MEDIUM 4.3

  Google Chrome contained a flaw in how it handled permissions that could allow an attacker to trick users into visiting a specially crafted web page and leak data from other websites the user was visiting. The vulnerability requires user interaction (clicking or viewing a malicious page) and only affects data confidentiality, not system availability or integrity. Google has patched this in Chrome 149.0.7827.53 and later.

• CVE-2026-13905MEDIUM 4.2

  Google Chrome for iOS contains a race condition that could allow an attacker with physical access to an iOS device to read sensitive information from the browser's process memory. The vulnerability requires the attacker to be present at the device and involves timing-sensitive manipulation, making opportunistic exploitation difficult. This affects Chrome versions before 150.0.7871.47 on iOS.

• CVE-2026-14133MEDIUM 4.2

  A race condition in Google Chrome's history embeddings feature could allow an attacker to trick users into seeing fake browser UI elements through a specially crafted webpage. The vulnerability requires user interaction and is difficult to exploit reliably, but successful exploitation could lead to minor information disclosure or allow the attacker to manipulate what the user sees on screen. Chrome versions before 150.0.7871.47 are affected.

• CVE-2026-55945MEDIUM 4.2

  Microsoft Edge (Chromium-based) contains a race condition that allows an authorized attacker with local access to disclose sensitive information. The vulnerability arises from improper synchronization when multiple threads or processes access a shared resource concurrently. An attacker must already have local user privileges and knowledge of specific timing conditions to exploit this vulnerability successfully.

• CVE-2026-46693MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation suite, contains a race condition vulnerability in its distributed cache service. An attacker with local access to a system running the magick -distribute-cache service can exploit a timing window to hijack a file descriptor belonging to the server process, potentially gaining unauthorized read access to sensitive data the server is handling. This is a local privilege escalation scenario requiring both network access to the cache service and precise timing to trigger.

• CVE-2026-10565LOW 3.1

  A race condition vulnerability has been discovered in Open5GS versions up to 2.7.6 that affects the NGAP Handover security mode processing function. The flaw allows an authenticated attacker to trigger a timing-dependent race condition that results in a denial-of-service condition. While a public exploit exists, successful exploitation requires specific conditions and careful timing, making real-world attacks difficult to execute reliably.

• CVE-2026-10654LOW 3.1

  A race condition in Zephyr's Bluetooth RFCOMM stack can cause a session to become permanently stuck when a local disconnect and an incoming peer disconnect happen at the same time. When this occurs, the session slot doesn't get released properly, preventing future Bluetooth connections with that peer. While the timing required to trigger this is difficult to achieve naturally, repeated occurrences could exhaust available RFCOMM session capacity and deny Bluetooth service to users. The vulnerability only affects availability; no data is leaked or corrupted.

• CVE-2026-9959LOW 3.1

  A race condition in WebRTC functionality within Google Chrome on Windows allows an attacker to leak data across origin boundaries. The vulnerability requires user interaction (clicking on a crafted HTML page) and is difficult to exploit reliably due to timing constraints. While the underlying issue is rated High severity by Chromium, the CVSS 3.1 score of 3.1 reflects the practical barriers to exploitation and limited scope—an attacker can extract sensitive information, but cannot modify data or disrupt service.