Race Condition

Updated 31 Jul 2026

•
def
- •
  a bug where the outcome depends on the timing of two things happening at (or near) the same time, when that timing wasn't properly planned for
•
classic form
- •
  time-of-check to time-of-use (TOCTOU) — checking a condition, then having something change between the check and when the result of that check is actually used
•
example
- •
  two users simultaneously transferring $50 out of the same$ 100 account, if the system doesn't validate balances properly between the check and the transfer, can result in more money leaving the account than it ever held
•
real-world examples
- •
  January 2004 — the Mars rover Spirit entered a reboot loop caused by a race condition tied to its file system
- •
  Pwn2Own Vancouver 2023 — a TOCTOU attack against a Tesla Model 3's Bluetooth infotainment system achieved root privileges
•
related
- •
  Buffer Overflow
•
cards
- •
  What is a TOCTOU attack?
  - •
    Time-Of-Check to Time-Of-Use — exploiting the gap between when a condition is checked and when the result is actually used

Linked references 2