Weaknesses of type CWE-843

685 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2022-21734MEDIUM`CHECK`-failures in TensorflowEPSS 0.8%CVE-2025-50168HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-3889HIGHType confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.8%CVE-2025-49713HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-30357HIGHFoxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-43489MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.8%CVE-2026-4698HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.8%CVE-2025-21356HIGHMicrosoft Office Visio Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.7%CVE-2024-7550HIGHType Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%CVE-2023-26063CRITICALCertain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.EPSS 0.7%CVE-2026-50686HIGHWindows OLE Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-69717HIGHWindows Group Policy Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-33940HIGHHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialEPSS 0.7%CVE-2025-62518HIGHastral-tokio-tar Vulnerable to PAX Header DesynchronizationEPSS 0.7%CVE-2023-28162HIGHWhile implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentiallyEPSS 0.7%CVE-2023-24944MEDIUMWindows Bluetooth Driver Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-43357HIGHJavaScript specification issue may lead to type confusion and pointer dereference in implementationsEPSS 0.7%CVE-2023-38128HIGHAn out-of-bounds write vulnerability exists in the "HyperLinkFrame" stream parser of Ichitaro 2023 1.0.1.59372. A specially crafted documentEPSS 0.7%CVE-2023-0473HIGHType Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruptioEPSS 0.7%