Time-of-check Time-of-use (TOCTOU) Race Condition

Windows Kernel Elevation of Privilege Vulnerability

• Local privilege escalation
• Race condition

microsoft · windows 10 1507Jun 11, 2024

Microsoft Outlook Security Feature Bypass Vulnerability

• Pre-auth
• Race condition

microsoft · 365 appsJul 11, 2023

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.

• Local privilege escalation
• Race condition

vmware · esxiMar 4, 2025

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

• pre-auth RCE
• Race condition

wordpress · wordpressOct 31, 2026

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

• Race condition

linux · linux kernelJul 22, 2025

Windows Themes Remote Code Execution Vulnerability

• pre-auth RCE
• Race condition

microsoft · windows 11 21h2Sep 12, 2023

The issue was addressed with improved checks.

• Race condition

apple · ipadosJan 9, 2024

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490.

• Pre-auth
• Auth bypass
• Race condition

ivanti · avalancheMar 29, 2023

Versa Concerto Authentication Bypass File Write Remote Code Execution

• pre-auth RCE
• Auth bypass
• Race condition

versa-networks · concertoMay 21, 2025

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

• pre-auth RCE
• Race condition

apache · tomcatDec 17, 2024

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration

• Pre-auth
• Race condition

nvidia · nvidia container toolkitSep 26, 2024

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

• pre-auth RCE
• Race condition

apache · tomcatDec 20, 2024

Windows Print Spooler Elevation of Privilege Vulnerability

• RCE
• Local privilege escalation
• Race condition

microsoft · windows 10Aug 17, 2020

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one use

• Pre-auth
• Race condition

keybase · keybaseJan 31, 2019

Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)

• Pre-auth
• SSRF
• Race condition

manager-io · managerNov 7, 2025

Windows Registry Elevation of Privilege Vulnerability

• Pre-auth
• Race condition

microsoft · windows 10 1809Nov 12, 2024

Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable`

• Pre-auth
• Race condition

plataformatec · deviseApr 3, 2019

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py.

• pre-auth RCE
• Race condition

openstack · magnumApr 12, 2024

Windows Partition Management Driver Elevation of Privilege Vulnerability

• Pre-auth
• Race condition

microsoft · windows 10 1507Jul 11, 2023

batman-adv: tt: fix TOCTOU race for reported vlans

• Pre-auth
• Race condition

linux · linux kernelJul 19, 2026

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root

• Race condition

webpros · pleskSep 10, 2026

Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

• Race condition

canonical · lxdAug 12, 2026

Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to

• pre-auth RCE
• Race condition

google · chromeOct 20, 2026

TOCTOU Vulnerability in file exchange

• Pre-auth
• Race condition

sauter · modu680-asSep 1, 2026

ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition

• pre-auth RCE
• Race condition

oxygenz · clipbucketFeb 10, 2026