Use of Multiple Resources with Duplicate Identifier

When software is designed to assume that identifiers like file handles, session tokens, or database keys are always unique, sharing identifiers between resources breaks this fundamental assumption. This can happen due to race conditions, insufficient validation, or flawed resource allocation logic, creating a situation where the application cannot reliably distinguish between different objects or data streams. An attacker can exploit this by forcing two distinct resources—such as files, memory blocks, or user sessions—to be referenced by the same identifier. This causes the application to perform actions on the wrong resource, potentially leading to data corruption, information disclosure, or privilege escalation, as the system's control flow is diverted based on a compromised identifier.