Weaknesses of type CWE-843

808 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2025-47151CRITICALA type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specialEPSS 1.1%CVE-2022-2971HIGHMZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')EPSS 1.1%CVE-2021-41041—In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is EPSS 1.1%CVE-2024-54505HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.EPSS 1.1%CVE-2026-66321HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.1%CVE-2025-29791HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 1.1%CVE-2017-16745—A Type Confusion issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. An accessEPSS 1.1%CVE-2022-1786—A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with moreEPSS 1.0%CVE-2025-25000HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-43596MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.0%CVE-2025-31206MEDIUMA type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7EPSS 1.0%CVE-2022-37377HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537;. User interEPSS 1.0%CVE-2019-10980—A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attEPSS 1.0%CVE-2023-32664HIGHA type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted JEPSS 1.0%CVE-2026-54116MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 1.0%CVE-2024-34394HIGHlibxmljs2 namespaces type confusion RCEEPSS 1.0%CVE-2023-24823CRITICALRIOT-OS vulnerable to Packet Type Confusion during IPHC sendEPSS 1.0%CVE-2026-70167HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 1.0%CVE-2021-34866HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first EPSS 1.0%CVE-2024-34393HIGHlibxmljs2 attrs type confusion RCEEPSS 1.0%