Weaknesses of type CWE-843

808 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2026-112659HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27EPSS 0.6%CVE-2026-106240HIGHType confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.6%CVE-2026-16410CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.6%CVE-2026-58592HIGHLadybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM IntegrationEPSS 0.5%CVE-2026-17697CRITICALType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.5%CVE-2026-26110HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-81401MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-1215HIGHType confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2026-94083CRITICALSuricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even thEPSS 0.5%CVE-2025-50176HIGHDirectX Graphics Kernel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-116782HIGHFreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handlingEPSS 0.5%CVE-2026-86974HIGHA type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPEPSS 0.5%CVE-2026-16392CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.5%CVE-2024-5837HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viEPSS 0.5%CVE-2025-65080MEDIUMType confusion vulnerability in Postscript interpreterEPSS 0.5%CVE-2025-65570CRITICALA type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an EPSS 0.5%CVE-2025-59233HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-59231HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-10231HIGHType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.5%CVE-2026-5865HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%