Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-112659HIGHA type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27EPSS 0.6%CVE-2026-106240HIGHType confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.6%CVE-2026-16410CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.6%CVE-2026-58592HIGHLadybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM IntegrationEPSS 0.5%CVE-2026-17697CRITICALType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.5%CVE-2026-26110HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-81401MEDIUMMicrosoft Excel Information Disclosure VulnerabilityEPSS 0.5%CVE-2023-1215HIGHType confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 0.5%CVE-2026-94083CRITICALSuricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even thEPSS 0.5%CVE-2025-50176HIGHDirectX Graphics Kernel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-116782HIGHFreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handlingEPSS 0.5%CVE-2026-86974HIGHA type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPEPSS 0.5%CVE-2026-16392CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.5%CVE-2024-5837HIGHType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viEPSS 0.5%CVE-2025-65080MEDIUMType confusion vulnerability in Postscript interpreterEPSS 0.5%CVE-2025-65570CRITICALA type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an EPSS 0.5%CVE-2024-45112HIGHAcrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.5%CVE-2025-59233HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-59231HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-10231HIGHType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.5%