Fallos del tipo CWE-843

684 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-79769HIGHNokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_argsEPSS 0.2%CVE-2025-8354HIGHRFA File Parsing Type Confusion VulnerabilityEPSS 0.2%CVE-2026-64693MEDIUMA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, EPSS 0.2%CVE-2026-11785MEDIUM389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handlerEPSS 0.2%CVE-2026-27298HIGHAdobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.2%CVE-2026-39956MEDIUMjq: Missing runtime type checks for _strindices lead to crash and limited memory disclosureEPSS 0.2%CVE-2026-8554LOWType Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-17866MEDIUMType Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-57254HIGHFoxit PDF Editor/Reader Annotation Type Confusion VulnerabilityEPSS 0.2%CVE-2024-40676HIGHIn checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to aEPSS 0.2%CVE-2026-5914HIGHType Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to pEPSS 0.2%CVE-2026-43862LOWIn mutt before 2.3.2, the imap_auth_gss security level is mishandled.EPSS 0.2%CVE-2023-0083MEDIUMThe ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.EPSS 0.2%CVE-2023-51428MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2023-51427MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2023-23443MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2024-58253LOWIn the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversionEPSS 0.2%CVE-2023-51426MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2026-15461MEDIUMType confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS inputEPSS 0.2%CVE-2026-14119MEDIUMType Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain poEPSS 0.2%