Falhas do tipo CWE-704

94 resultados

Conversão ou casting incorreto de tipo

Ocorre quando o código converte um objeto ou dado de um tipo para outro de forma inadequada, sem validar se a conversão é segura ou se preserva a semântica esperada. Isso pode levar a interpretações erradas dos dados, corrupção de estado ou execução de código com privilégios indevidos.

Exemplo

Um aplicativo recebe um ponteiro genérico (void*) de rede e faz casting direto para uma estrutura específica sem verificar o tipo real. Se o servidor enviar dados de um tipo diferente, o acesso aos campos interpretará lixo de memória como valores válidos, causando lógica corrompida ou crash.

Como mitigar

Implemente validação de tipo antes de qualquer conversão (use type tags, discriminadores ou metadados). Prefira conversões explícitas que falham seguramente em vez de casts silenciosos; em linguagens como C, use structs com type identifiers ou serialize/desserialize com schema validation (JSON Schema, Protocol Buffers).

CVE-2021-4456MEDIUMNet::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impactEPSS 0.3%CVE-2026-53798MEDIUMrsync < 3.5.0 Privilege Confusion via name-converter uid/gid mappingEPSS 0.3%CVE-2026-58822CRITICALIn multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code executiEPSS 0.3%CVE-2026-10080MEDIUMBoards plugin panics on WebSocket command with non-string field typesEPSS 0.3%CVE-2025-71002MEDIUMA floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) viEPSS 0.3%CVE-2026-34379HIGHOpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)EPSS 0.3%CVE-2026-28609HIGHIn read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution EPSS 0.3%CVE-2025-13720HIGHBad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentiallyEPSS 0.3%CVE-2026-25503HIGHiccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()EPSS 0.3%CVE-2026-22041LOWloggingredactor converts non-string types to string types in logsEPSS 0.3%CVE-2023-7345MEDIUMLedger Live hw-app-eth EIP-712 Message Parsing Integer TruncationEPSS 0.3%CVE-2026-42576MEDIUMapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoveryEPSS 0.3%CVE-2024-35303HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (AllEPSS 0.3%CVE-2026-25613HIGHAn unsafe cast in the MongoDB query planner can result in a segmentation fault.EPSS 0.2%CVE-2026-50278MEDIUMiccDEV: CIccEmbedIO::Read8() size_t underflowEPSS 0.2%CVE-2026-24856HIGHiccDEV has UB runtime error in <icTagTypeSignature>EPSS 0.2%CVE-2023-45204HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (AllEPSS 0.2%CVE-2026-86348MEDIUMMS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin processEPSS 0.2%CVE-2026-6726HIGHAn information leakage vulnerability in the TCG TPM 2.0 reference code.EPSS 0.2%CVE-2022-49873MEDIUMbpf: Fix wrong reg type conversion in release_reference()EPSS 0.2%