Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-8540HIGHType Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a craEPSS 0.3%CVE-2026-29079HIGHType Confusion in Lexbor Fragment ParserEPSS 0.3%CVE-2026-116111MEDIUM2K Games Civilization V Lua Sandbox loadstring type confusionEPSS 0.3%CVE-2026-25204MEDIUMDeserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process aEPSS 0.3%CVE-2026-70205HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-26162HIGHWindows OLE Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-114598HIGHAccess of resource using incompatible type ('type confusion') in EPICS BaseEPSS 0.3%CVE-2025-2197MEDIUMType Confusion Vulnerability in BrowserEPSS 0.3%CVE-2026-24874CRITICALType confusion in xray-monolithEPSS 0.3%CVE-2024-13047HIGHAshlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-34379HIGHOpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)EPSS 0.3%CVE-2026-80161HIGHAcrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.3%CVE-2026-80185MEDIUMBluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as rootEPSS 0.3%CVE-2026-7927HIGHType Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via aEPSS 0.3%CVE-2026-6363HIGHType Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access vEPSS 0.3%CVE-2025-66342HIGHA type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerabilitEPSS 0.3%CVE-2026-118315HIGHType confusion in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sanEPSS 0.3%CVE-2026-118350HIGHType confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox viEPSS 0.3%CVE-2026-45600HIGHWindows Kernel-Mode Driver Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-32814HIGHA type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, EPSS 0.3%