Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-22153HIGHtry/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreterEPSS 0.4%CVE-2024-38207MEDIUMMicrosoft Edge (HTML-based) Memory Corruption VulnerabilityEPSS 0.4%CVE-2023-38091HIGHKofax Power PDF response Type Confusion Remote Code Execution VulnerabilityEPSS 0.4%CVE-2023-44094—Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.EPSS 0.4%CVE-2026-83763HIGHWindows Input System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2022-29209MEDIUMType confusion leading to `CHECK`-failure based denial of service in TensorFlowEPSS 0.4%CVE-2026-44325HIGHfree5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)EPSS 0.4%CVE-2026-83664MEDIUMWindows Portable Device File System Driver Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-10962HIGHType Confusion in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cEPSS 0.4%CVE-2026-10935HIGHType Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.4%CVE-2026-10936HIGHType Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafEPSS 0.4%CVE-2026-116370MEDIUM2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusionEPSS 0.4%CVE-2024-53427HIGHdecNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-EPSS 0.4%CVE-2024-32063HIGHA vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type confusion vulnerabilEPSS 0.4%CVE-2024-32057HIGHA vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type confusion vulnerabilEPSS 0.4%CVE-2024-32062HIGHA vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type confusion vulnerabilEPSS 0.4%CVE-2022-50590HIGHSuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' FunctionalityEPSS 0.4%CVE-2025-59717MEDIUMIn the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring maEPSS 0.4%CVE-2026-96921MEDIUMWindows Message Queuing Queue Manager Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-88816HIGHDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyNameEPSS 0.4%