Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-24137HIGHA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.EPSS 1.0%CVE-2024-12053HIGHType Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a craftEPSS 1.0%CVE-2026-2796CRITICALJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.9%CVE-2025-29806MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-5830HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafteEPSS 0.9%CVE-2024-0518HIGHType confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.9%CVE-2023-3216HIGHType confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.9%CVE-2026-83642HIGHWindows Domain Name Service Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-26232HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-38219MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2026-72938MEDIUMMicrosoft Office PowerPoint Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-3889HIGHType confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.9%CVE-2023-23557CRITICALAn error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malEPSS 0.9%CVE-2023-25933CRITICALA type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to EPSS 0.9%CVE-2026-10702MEDIUMJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.9%CVE-2022-21731MEDIUMType confusion leading to segfault in TensorflowEPSS 0.9%CVE-2026-102203HIGHRPC Runtime Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-21675HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-102869HIGH.NET and Visual Studio Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-1938HIGHType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafteEPSS 0.8%