Weaknesses of type CWE-843

685 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2025-47167HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-15646CRITICALHTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusionEPSS 0.7%CVE-2024-47804MEDIUMIf an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroEPSS 0.7%CVE-2023-1214HIGHType confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.7%CVE-2026-2796CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.7%CVE-2024-7652HIGHType Confusion in Async Generators in Javascript EngineEPSS 0.7%CVE-2021-39987HIGHThe HwNearbyMain module has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause a process to restEPSS 0.7%CVE-2024-38209HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-61674CRITICALFluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handlerEPSS 0.7%CVE-2026-69679MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-69637MEDIUMWindows DHCP Server Denial of Service VulnerabilityEPSS 0.6%CVE-2026-16919CRITICALVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.6%CVE-2022-3676MEDIUMIn Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of tEPSS 0.6%CVE-2024-10230HIGHType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.6%CVE-2026-44628HIGHOFFIS DCMTK Toolkit Type ConfusionEPSS 0.6%CVE-2026-6732MEDIUMLibxml2: libxml2: denial of service via crafted xsd-validated documentEPSS 0.6%CVE-2024-56522HIGHAn issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function EPSS 0.6%CVE-2024-5158HIGHType Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a craEPSS 0.6%CVE-2026-59940CRITICALSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationEPSS 0.6%CVE-2025-0147HIGHZoom Workplace App for Linux - Type ConfusionEPSS 0.6%