Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-59717MEDIUMIn the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring maEPSS 0.4%CVE-2026-78956HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary coEPSS 0.4%CVE-2026-10955HIGHType Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds meEPSS 0.4%CVE-2024-11508HIGHIrfanView DXF File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-11507HIGHIrfanView DXF File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-14423CRITICALType Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craftEPSS 0.4%CVE-2024-5271HIGHFuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')EPSS 0.4%CVE-2025-22151LOWStrawberry GraphQL has a type resolution vulnerabilityEPSS 0.4%CVE-2026-44817HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-6301HIGHType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2026-13066HIGHServer-Side JavaScript DBPointer BSON Serialization Memory DisclosureEPSS 0.4%CVE-2025-43297MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26. An app may be able to cause a denEPSS 0.4%CVE-2024-7825—Type confusion that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2026-6307HIGHType Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2024-53427HIGHdecNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-EPSS 0.4%CVE-2022-50590HIGHSuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' FunctionalityEPSS 0.4%CVE-2025-30445MEDIUMA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.EPSS 0.4%CVE-2024-13275MEDIUMSecurity Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039EPSS 0.4%CVE-2026-16420HIGHType Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox viaEPSS 0.4%CVE-2026-16392CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.4%