Falhas do tipo CWE-843

681 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-79045HIGHType confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside tEPSS 0.3%CVE-2024-3298HIGHOut-Of-Bounds Write and Type Confusion vulnerabilities exist in the DWG and DXF file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024EPSS 0.3%CVE-2025-61911MEDIUMpython-ldap has sanitization bypass in ldap.filter.escape_filter_charsEPSS 0.3%CVE-2026-14148MEDIUMType Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.3%CVE-2026-85051HIGHType confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandboxEPSS 0.3%CVE-2025-12899MEDIUMnet: icmp: Out of bound memory readEPSS 0.3%CVE-2026-74976MEDIUMJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2024-30266LOWWasmtime vulnerable to panic when using a dropped extenref-typed element segmentEPSS 0.3%CVE-2026-70584HIGHWindows Core Messaging Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-69324HIGHWindows Performance Monitor Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-87612HIGHType confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crEPSS 0.3%CVE-2024-40788MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOSEPSS 0.3%CVE-2025-30310HIGHDreamweaver Desktop | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.3%CVE-2026-34344HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-48756LOWIn group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.gEPSS 0.3%CVE-2026-11463MEDIUMUSCiLab Cereal Shared Pointer type confusionEPSS 0.3%CVE-2023-23454MEDIUMcbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds readEPSS 0.3%CVE-2026-11076HIGHType Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.3%CVE-2026-61932HIGHWindows DWM Core Library Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-50433MEDIUMmarshall in dhcp_packet.c in simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service by sending a malicious EPSS 0.3%