Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2025-13229HIGHType Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 0.2%CVE-2025-22435CRITICALIn avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of EPSS 0.2%CVE-2026-35541MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to tyEPSS 0.2%CVE-2026-5496HIGHLabcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.2%CVE-2024-54524MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to access arEPSS 0.2%CVE-2026-80185MEDIUMBluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as rootEPSS 0.2%CVE-2026-70339MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.2%CVE-2025-43355MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, mEPSS 0.2%CVE-2026-0162HIGHIn ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code executioEPSS 0.2%CVE-2026-40446MEDIUMAccess of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.ThisEPSS 0.2%CVE-2024-13049HIGHAshlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-11196MEDIUMType Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.2%CVE-2023-6045MEDIUMArkruntime has a type confusion vulnerabilityEPSS 0.2%CVE-2026-80183HIGHIn OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignmentEPSS 0.2%CVE-2023-37376HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (AllEPSS 0.2%CVE-2026-8358MEDIUMHeap buffer overflow in spreadsheet tracked-changes importEPSS 0.2%CVE-2026-7914HIGHType Confusion in Accessibility in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the rendereEPSS 0.2%CVE-2025-66586HIGHType Confusion vulnerability in AzeoTech DAQFactoryEPSS 0.2%CVE-2025-7230HIGHINVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.2%CVE-2026-21330HIGHAfter Effects | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.2%