Weaknesses of type CWE-843

685 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2026-17697CRITICALType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.5%CVE-2025-59233HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-5837HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viEPSS 0.5%CVE-2025-59231HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-16239HIGHPostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codeEPSS 0.5%CVE-2024-45112HIGHAcrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.5%CVE-2026-17725HIGHType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2024-5838HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted EPSS 0.5%CVE-2024-5833HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viEPSS 0.5%CVE-2026-45635HIGHWindows UPnP Device Host Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-65570CRITICALA type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an EPSS 0.5%CVE-2026-79236HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%CVE-2024-5597HIGHFuji Electric Monitouch V-SFT Type ConfusionEPSS 0.5%CVE-2024-8904HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.5%CVE-2025-65080MEDIUMType confusion vulnerability in Postscript interpreterEPSS 0.5%CVE-2026-58295HIGHMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2024-7969HIGHType Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2025-14330CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.5%CVE-2026-43705HIGHA type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 EPSS 0.5%CVE-2023-24599—OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbersEPSS 0.5%