The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Synchronization refers to a variety of behaviors and mechanisms that allow two or more independently-operating processes or threads to ensure that they operate on shared resources in predictable ways that do not interfere with each other. Some shared resource operations cannot be executed atomically; that is, multiple steps must be guaranteed to execute sequentially, without any interference by other processes. Synchronization mechanisms vary widely, but they may include locking, mutexes, and semaphores. When a multi-step operation on a shared resource cannot be guaranteed to execute independent of interference, then the resulting behavior can be unpredictable. Improper synchronization could lead to data or memory corruption, denial of service, etc.

Primary

Architecture and Design

Implementation

Integrity
Confidentiality
Other
Modify Application Data
Read Application Data
Alter Execution Logic

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Implementation
Use industry standard APIs to synchronize your code.

The following function attempts to acquire a lock in order to perform operations on a shared resource.

void f(pthread_mutex_t *mutex) {
pthread_mutex_lock(mutex);

/* access shared resource */

pthread_mutex_unlock(mutex);
}

However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.
In order to avoid data races, correctly written programs must check the result of thread synchronization functions and appropriately handle all errors, either by attempting to recover from them or reporting them to higher levels.

int f(pthread_mutex_t *mutex) {
int result;
result = pthread_mutex_lock(mutex);if (0 != result)return result;

/* access shared resource */

return pthread_mutex_unlock(mutex);
}

The following code intends to fork a process, then have both the parent and child processes print a single line.

static void print (char * string) {
char * word;int counter;for (word = string; counter = *word++; ) {
putc(counter, stdout);fflush(stdout);
/* Make timing window a little larger... */

sleep(1);
}
}
int main(void) {
pid_t pid;
pid = fork();if (pid == -1) {exit(-2);}else if (pid == 0) {print("child\n");}else {print("PARENT\n");}exit(0);
}

One might expect the code to print out something like:

PARENT
child

However, because the parent and child are executing concurrently, and stdout is flushed each time a character is printed, the output might be mixed together, such as:

PcAhRiElNdT
[blank line]
[blank line]

CVE-2021-1782
Chain: improper locking (CWE-667) leads to race condition (CWE-362), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-1782

CVE-2009-0935
Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice
https://www.cve.org/CVERecord?id=CVE-2009-0935

SIG00-C
Mask signals handled by noninterruptible signal handlers

SIG31-C
Do not access shared objects in signal handlers
CWE More Abstract

State synchronization error

VNA03-J
Do not assume that a group of calls to independently atomic methods is atomic

SFP19
Missing Lock

Discouraged
This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

Deeper research is necessary for synchronization and related mechanisms, including locks, mutexes, semaphores, and other mechanisms. Multiple entries are dependent on this research, which includes relationships to concurrency, race conditions, reentrant functions, etc. CWE-662 and its children - including CWE-667, CWE-820, CWE-821, and others - may need to be modified significantly, along with their relationships.

CWE Community
2008-04-11
Draft 9
2008-04-11
Submitted by members of the CWE community to extend early CWE versions

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships

CWE Content Team
MITRE
2008-10-14
updated Relationships

CWE Content Team
MITRE
2008-11-24
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-03-10
updated Related_Attack_Patterns

CWE Content Team
MITRE
2009-05-27
updated Relationships

CWE Content Team
MITRE
2010-09-27
updated Name, Relationships

CWE Content Team
MITRE
2010-12-13
updated Description, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-09-13
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2013-07-17
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2019-06-20
updated Type

CWE Content Team
MITRE
2019-09-23
updated Description, Maintenance_Notes, Relationships

CWE Content Team
MITRE
2020-02-24
updated Description, Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Description, Detection_Factors, Relationships, Weakness_Ordinalities

Insufficient Synchronization