Weaknesses of type CWE-843

808 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2024-34393HIGHlibxmljs2 attrs type confusion RCEEPSS 1.0%CVE-2025-24137HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.EPSS 1.0%CVE-2024-12053HIGHType Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a craftEPSS 1.0%CVE-2026-2796CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.9%CVE-2025-29806MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-5830HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafteEPSS 0.9%CVE-2024-0518HIGHType confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.9%CVE-2023-3216HIGHType confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.9%CVE-2026-83642HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-26232HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-38219MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-72938MEDIUMMicrosoft Office PowerPoint Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-3889HIGHType confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.9%CVE-2023-23557CRITICALAn error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malEPSS 0.9%CVE-2023-25933CRITICALA type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to EPSS 0.9%CVE-2026-10702MEDIUMJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.9%CVE-2022-21731MEDIUMType confusion leading to segfault in TensorflowEPSS 0.9%CVE-2026-102203HIGHRPC Runtime Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21675HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-102869HIGH.NET and Visual Studio Elevation of Privilege VulnerabilityEPSS 0.8%