Weaknesses of type CWE-843

686 results

Confusão de Tipos

Ocorre quando o programa trata uma variável ou objeto como se fosse de um tipo diferente do seu tipo real, levando a comportamentos impredizíveis. O atacante explora essa interpretação errada para contornar validações, corromper memória ou executar código arbitrário.

Example

Um aplicativo recebe um valor que valida como inteiro, mas a função que o processa o interpreta como um ponteiro de memória. O código tenta acessar e modificar dados no endereço apontado, causando corrupção ou exposição de informações sensíveis.

How to mitigate

Implemente validação rigorosa e conversão explícita de tipos antes de usar qualquer dado externo. Use linguagens com verificação forte de tipos em tempo de compilação e, quando necessário, valide tanto o tipo quanto o intervalo de valores esperados. Testes de fuzzing e análise estática ajudam a detectar confusões de tipo.

CVE-2024-11508HIGHIrfanView DXF File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-17687CRITICALType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.4%CVE-2024-5271HIGHFuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')EPSS 0.4%CVE-2026-79045HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside tEPSS 0.4%CVE-2026-14423CRITICALType Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craftEPSS 0.4%CVE-2026-17697CRITICALType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.4%CVE-2025-22151LOWStrawberry GraphQL has a type resolution vulnerabilityEPSS 0.4%CVE-2026-40683HIGHIn OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enableEPSS 0.4%CVE-2026-84635MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvEPSS 0.4%CVE-2026-13066HIGHServer-Side JavaScript DBPointer BSON Serialization Memory DisclosureEPSS 0.4%CVE-2025-43297MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26. An app may be able to cause a denEPSS 0.4%CVE-2024-7825—Type confusion that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2026-40364HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-53427HIGHdecNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-EPSS 0.4%CVE-2022-50590HIGHSuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' FunctionalityEPSS 0.4%CVE-2025-30445MEDIUMA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.EPSS 0.4%CVE-2024-13275MEDIUMSecurity Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039EPSS 0.4%CVE-2026-16392CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.4%CVE-2021-39219MEDIUMWrong type for `Linker`-define functions when used across two `Engine`sEPSS 0.4%CVE-2022-42841HIGHA type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 1EPSS 0.4%