CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition

Abstraction: Base · CVEs in our corpus: 838

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Last updated: 26 September 2026 20:40 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

AU-8 Time Stamps
PR.PS-06
AC-3 Access Enforcement
AC-25 Reference Monitor

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V15.4.2
V17.2.6

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`AU-8`	Time Stamps	AU	Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-35311` KEV	9.2	8.8	0.1552	2023-07-11
`CVE-2025-22224` KEV	9.2	9.3	0.0156	2025-03-04
`CVE-2024-50379`	8.9	9.8	0.3182	2024-12-17
`CVE-2022-36980`	8.7	8.1	0.8314	2023-03-29
`CVE-2025-38352` KEV	8.5	7.8	0.0130	2025-07-22
`CVE-2023-38146`	8.3	8.8	0.3738	2023-09-12
`CVE-2025-34027`	8.3	9.0	0.4522	2025-05-21
`CVE-2024-0132`	8.2	9.0	0.4084	2024-09-26
`CVE-2024-56337`	8.1	9.8	0.0897	2024-12-20
`CVE-2022-48618` KEV	7.9	7.0	0.0049	2024-01-09
`CVE-2024-30088` KEV	7.9	7.0	0.6820	2024-06-11
`CVE-2021-32708`	7.8	9.8	0.0349	2021-06-24
`CVE-2019-7249`	7.7	9.8	0.0251	2019-01-31
`CVE-2019-5421`	7.6	9.8	0.0156	2019-04-03
`CVE-2015-3246` KEV	7.5	5.1	0.0880	2015-08-11
`CVE-2024-28718`	7.5	9.8	0.0106	2024-04-12
`CVE-2024-41787`	7.5	9.8	0.0111	2025-01-10
`CVE-2024-41779`	7.4	9.8	0.0083	2024-11-22
`CVE-2026-25641`	7.4	10.0	0.0054	2026-02-06
`CVE-2026-37531`	7.4	9.8	0.0085	2026-05-01
`CVE-2026-64091`	7.4	9.8	0.0058	2026-07-19
`CVE-2024-27114`	7.3	9.8	0.0054	2024-09-11
`CVE-2025-64180`	7.3	10.0	0.0031	2025-11-07
`CVE-2024-43452`	7.2	7.5	0.2839	2024-11-12
`CVE-2026-53838`	7.2	9.8	0.0037	2026-06-12