Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-58290HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-32701HIGHQwik has array method pollution in FormData processing, allowing type confusion and DoSEPSS 0.4%CVE-2026-5360MEDIUMFree5GC aper type confusionEPSS 0.4%CVE-2026-45764CRITICALSuricata http2: protocol-change type confusion can lead to denial of serviceEPSS 0.4%CVE-2026-10910HIGHType Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.4%CVE-2026-7337HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.4%CVE-2026-14680HIGHPostgreSQL type confusion via "internal" argumentsEPSS 0.4%CVE-2026-14671HIGHPostgreSQL refint plan cache type confusion executes arbitrary codeEPSS 0.4%CVE-2024-7824—Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2025-55236HIGHGraphics Kernel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-76038HIGHType confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a cEPSS 0.4%CVE-2025-24213HIGHThis issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOEPSS 0.4%CVE-2023-51560HIGHFoxit PDF Reader Annotation Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-11395HIGHType Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.4%CVE-2026-16238HIGHPostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary codeEPSS 0.4%CVE-2026-31968HIGHHTSlib CRAM decoder vulnerable to buffer overflowEPSS 0.4%CVE-2026-91709HIGHType confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbEPSS 0.4%CVE-2026-79209HIGHType confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside tEPSS 0.4%CVE-2026-78938HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-16355CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.4%