Skip to content
application-security

TOCTOU

Time-of-Check Time-of-Use

Definition

TOCTOU is a class of race condition vulnerability where the state of a resource changes between when it is checked (access control verification) and when it is used (the operation). An attacker who can control or predict the timing can swap a file or resource between the check and use phases to bypass security controls.

TOCTOU vulnerabilities are common in file system operations, particularly in setuid programs and OS-level privilege checks.


Ship secure code faster

Crash Override integrates security into the developer workflow. No context switching, no waiting on reviews.