Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-79769HIGHNokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_argsEPSS 0.2%CVE-2025-8354HIGHRFA File Parsing Type Confusion VulnerabilityEPSS 0.2%CVE-2026-64693MEDIUMA type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, EPSS 0.2%CVE-2026-11785MEDIUM389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handlerEPSS 0.2%CVE-2026-27298HIGHAdobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.2%CVE-2026-39956MEDIUMjq: Missing runtime type checks for _strindices lead to crash and limited memory disclosureEPSS 0.2%CVE-2026-8554LOWType Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-17866MEDIUMType Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process EPSS 0.2%CVE-2026-57254HIGHFoxit PDF Editor/Reader Annotation Type Confusion VulnerabilityEPSS 0.2%CVE-2024-40676HIGHIn checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to aEPSS 0.2%CVE-2026-5914HIGHType Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to pEPSS 0.2%CVE-2026-43862LOWIn mutt before 2.3.2, the imap_auth_gss security level is mishandled.EPSS 0.2%CVE-2023-0083MEDIUMThe ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.EPSS 0.2%CVE-2023-51428MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2023-51427MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2023-23443MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2024-58253LOWIn the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversionEPSS 0.2%CVE-2023-51426MEDIUM Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak. EPSS 0.2%CVE-2026-15461MEDIUMType confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS inputEPSS 0.2%CVE-2026-14119MEDIUMType Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain poEPSS 0.2%