Fallos del tipo CWE-843

808 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2026-43456HIGHbonding: fix type confusion in bond_setup_by_slave()EPSS 0.2%CVE-2026-21493MEDIUMiccDEV has Type Confusion during XML Curve SerializationEPSS 0.2%CVE-2026-72844MEDIUMLean 4 Kernel Type Checking Bypass via Mismatched Structure ProjectionsEPSS 0.2%CVE-2026-12390HIGHAccess of resource using incompatible type ('type confusion') in AzeoTech DAQFactoryEPSS 0.2%CVE-2026-120646—CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfoEPSS 0.2%CVE-2025-43236LOWA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VeEPSS 0.2%CVE-2025-8354HIGHRFA File Parsing Type Confusion VulnerabilityEPSS 0.2%CVE-2026-11785MEDIUM389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handlerEPSS 0.2%CVE-2026-65409MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, mEPSS 0.2%CVE-2026-27298HIGHAdobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.2%CVE-2026-18417MEDIUMWild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous errorEPSS 0.2%CVE-2026-77237HIGHMissing type validation in xQueueAddToSet in FreeRTOS-KernelEPSS 0.2%CVE-2026-39956MEDIUMjq: Missing runtime type checks for _strindices lead to crash and limited memory disclosureEPSS 0.2%CVE-2026-8554LOWType Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-57254HIGHFoxit PDF Editor/Reader Annotation Type Confusion VulnerabilityEPSS 0.2%CVE-2024-40676HIGHIn checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to aEPSS 0.2%CVE-2026-20508MEDIUMIn Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicEPSS 0.2%CVE-2026-112550MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macEPSS 0.2%CVE-2024-58253LOWIn the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversionEPSS 0.2%CVE-2026-5914HIGHType Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to pEPSS 0.2%