Falhas do tipo CWE-843

684 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-45702MEDIUMOP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panicEPSS 0.2%CVE-2026-20451MEDIUMIn slbc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actoEPSS 0.2%CVE-2024-21834LOWArkui has a type confusion vulnerabilityEPSS 0.2%CVE-2026-59304LOWImproper caching of the original content type in Spring Cloud Stream AvroEPSS 0.2%CVE-2026-58305MEDIUMAccess of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. ThEPSS 0.2%CVE-2025-25277MEDIUMarkcompiler_ets_runtime has a type confusion vulnerabilityEPSS 0.2%CVE-2026-10022HIGHType Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to eEPSS 0.2%CVE-2026-18458MEDIUMOut-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.EPSS 0.1%CVE-2026-11389MEDIUMOut-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.EPSS 0.1%CVE-2024-31071LOWArkcompiler Ets Runtime has a type confusion vulnerabilityEPSS 0.1%CVE-2024-36278LOWArkcompiler Ets Runtime has a type confusion vulnerabilityEPSS 0.1%CVE-2023-31322HIGHType confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted EPSS 0.1%CVE-2023-31323HIGHType confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory InterconEPSS 0.1%CVE-2023-49602LOWArkui has a type confusion vulnerabilityEPSS 0.1%CVE-2026-77237HIGHMissing type validation in xQueueAddToSet in FreeRTOS-KernelEPSS 0.1%CVE-2025-20063LOWarkui_ace_engine has a type confusion vulnerabilityEPSS 0.1%CVE-2025-21082LOWarkui_ace_engine has a type confusion vulnerabilityEPSS 0.1%CVE-2026-44728HIGHImproper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjsEPSS 0.1%CVE-2026-84602MEDIUMA type confusion issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoldEPSS 0.1%CVE-2026-65409MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, mEPSS 0.1%