Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-62765HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-84563HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app EPSS 0.4%CVE-2026-10910HIGHType Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.4%CVE-2026-7337HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.4%CVE-2026-14680HIGHPostgreSQL type confusion via "internal" argumentsEPSS 0.4%CVE-2026-14671HIGHPostgreSQL refint plan cache type confusion executes arbitrary codeEPSS 0.4%CVE-2026-70245HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-7824—Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dumpEPSS 0.4%CVE-2026-33055MEDIUMtar-rs incorrectly ignores PAX size headers if header size is nonzeroEPSS 0.4%CVE-2026-8389HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.4%CVE-2026-43705HIGHA type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 EPSS 0.4%CVE-2024-49196HIGHAn issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. Type confusion leads to a Denial of Service.EPSS 0.4%CVE-2023-51560HIGHFoxit PDF Reader Annotation Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-82057HIGHType Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of ServiceEPSS 0.4%CVE-2025-41738HIGHCODESYS Control - Invalid type usage in visualizationEPSS 0.4%CVE-2026-102323HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-102299HIGHType confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.4%CVE-2026-16238HIGHPostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary codeEPSS 0.4%CVE-2026-13883CRITICALType Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafEPSS 0.4%CVE-2026-70339MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.4%