Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2025-2022HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2015HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-2018HIGHAshlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-22028HIGHPreact has JSON VNode Injection issueEPSS 0.3%CVE-2026-87564MEDIUMType confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML EPSS 0.3%CVE-2026-9117HIGHType Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the rendererEPSS 0.3%CVE-2026-29079HIGHType Confusion in Lexbor Fragment ParserEPSS 0.3%CVE-2026-24874CRITICALType confusion in xray-monolithEPSS 0.3%CVE-2024-20078CRITICALIn venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System executiEPSS 0.3%CVE-2025-29867HIGHAccess of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom Inc. Hancom Office 202EPSS 0.3%CVE-2026-11052CRITICALType Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process EPSS 0.3%CVE-2026-9983HIGHType Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.3%CVE-2026-43038CRITICALipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()EPSS 0.3%CVE-2026-9334HIGHCpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabledEPSS 0.3%CVE-2026-34595MEDIUMParse Server: LiveQuery protected-field guard bypass via array-like logical operator valueEPSS 0.3%CVE-2026-8570MEDIUMType Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.3%CVE-2025-13227HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.2%CVE-2025-13230HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.2%CVE-2025-13226HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.2%CVE-2025-13228HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.2%