Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-43038CRITICALipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()EPSS 0.3%CVE-2026-108518LOWDBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} elementEPSS 0.3%CVE-2026-9334HIGHCpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabledEPSS 0.3%CVE-2026-5496HIGHLabcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.3%CVE-2026-35541MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to tyEPSS 0.3%CVE-2026-8570MEDIUMType Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.3%CVE-2026-15461MEDIUMType confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS inputEPSS 0.2%CVE-2025-22435CRITICALIn avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of EPSS 0.2%CVE-2026-21330HIGHAfter Effects | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.2%CVE-2024-54524MEDIUMA logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to access arEPSS 0.2%CVE-2025-43355MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, mEPSS 0.2%CVE-2026-40446MEDIUMAccess of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.ThisEPSS 0.2%CVE-2026-0162HIGHIn ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code executioEPSS 0.2%CVE-2026-11196MEDIUMType Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from proEPSS 0.2%CVE-2024-13049HIGHAshlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution VulnerabilityEPSS 0.2%CVE-2023-6045MEDIUMArkruntime has a type confusion vulnerabilityEPSS 0.2%CVE-2026-8358MEDIUMHeap buffer overflow in spreadsheet tracked-changes importEPSS 0.2%CVE-2023-37376HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (AllEPSS 0.2%CVE-2026-7914HIGHType Confusion in Accessibility in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the rendereEPSS 0.2%CVE-2025-66586HIGHType Confusion vulnerability in AzeoTech DAQFactoryEPSS 0.2%