Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-17697CRITICALType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.5%CVE-2024-5837HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viEPSS 0.5%CVE-2025-59233HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-59231HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-16239HIGHPostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codeEPSS 0.5%CVE-2024-45112HIGHAcrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.5%CVE-2026-17725HIGHType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%CVE-2024-5838HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted EPSS 0.5%CVE-2024-5833HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viEPSS 0.5%CVE-2026-45635HIGHWindows UPnP Device Host Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-65570CRITICALA type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an EPSS 0.5%CVE-2026-79236HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.5%CVE-2024-5597HIGHFuji Electric Monitouch V-SFT Type ConfusionEPSS 0.5%CVE-2024-8904HIGHType Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.5%CVE-2025-65080MEDIUMType confusion vulnerability in Postscript interpreterEPSS 0.5%CVE-2026-58295HIGHMicrosoft Edge (Chromium-based) Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2024-7969HIGHType Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2025-14330CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.5%CVE-2026-43705HIGHA type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 EPSS 0.5%CVE-2026-5865HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.5%