CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Sources read 2026-11-03. MITRE's own page · All weakness notes · Added to CISA's list in the last seven days
What it is
From MITRE's CWE catalogue
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
MITRE classes it as a base-level weakness and rates the likelihood of exploit as medium.
What it lets an attacker do
From MITRE's CWE catalogue
- Alter Execution Logic, Unexpected State (affects: integrity, other)
- Modify Application Data, Modify Files or Directories, Modify Memory, Other (affects: integrity, other)
- Other (affects: integrity, other)
- Hide Activities (affects: non-repudiation)
On CISA's exploited list
From CISA's exploited list
1 of the 106 entries CISA added from 2026-08-07 to 2026-11-04 name CWE-367, against 0 of 71 in the 90 days before. Over the whole catalogue 6 entries name it. The counts are small, so read them as a rough order, not a rate.
CISA's list is not every flaw that is exploited: it holds the ones CISA has evidence of, listed on the day it added them.
- CVE-2026-119977, WordPress WordPress Core, added 2026-11-03
- CVE-2025-38352, Linux Kernel, added 2025-09-04
- CVE-2025-22224, VMware ESXi and Workstation, added 2025-03-04
- CVE-2024-30088, Microsoft Windows , added 2024-10-15
- CVE-2022-48618, Apple Multiple Products, added 2024-01-31
How MITRE says to find it
From MITRE's CWE catalogue
- Automated Static Analysis
What MITRE suggests
From MITRE's CWE catalogue
These are MITRE's suggestions, quoted as it gives them. They are not a complete fix and not a substitute for reading the vendor's advisory for the product you run.
- Implementation: The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
- Implementation: When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
- Architecture and Design: Limit the interleaving of operations on files from multiple processes.
- Implementation: If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
Attack patterns MITRE links to it
From MITRE's CWE catalogue
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. You decide using our output, not our pitch.
Talk to us