Falhas do tipo CWE-843

808 resultados

Confusão de Tipo

Fraqueza onde o código trata um dado como se fosse de um tipo diferente do que realmente é, resultando em comportamento imprevisto e potencialmente perigoso. Um atacante pode explorar essa confusão para contornar validações, corromper memória ou executar código arbitrário.

Exemplo

Um navegador recebe um objeto JSON que deveria ser uma string, mas trata como um número inteiro para cálculos de offset em memória — ao somar um valor grande, o atacante causa leitura/escrita fora dos limites do buffer alocado.

Como mitigar

Sempre validar e converter explicitamente o tipo de dados na entrada, usando type checking ou casting seguro. Em linguagens com tipagem dinâmica (JavaScript, Python), adicione verificações de tipo antes de operações críticas; em linguagens compiladas, ative warnings de compilador para conversões implícitas suspeitas.

CVE-2026-43456HIGHbonding: fix type confusion in bond_setup_by_slave()EPSS 0.2%CVE-2026-21493MEDIUMiccDEV has Type Confusion during XML Curve SerializationEPSS 0.2%CVE-2026-72844MEDIUMLean 4 Kernel Type Checking Bypass via Mismatched Structure ProjectionsEPSS 0.2%CVE-2026-12390HIGHAccess of resource using incompatible type ('type confusion') in AzeoTech DAQFactoryEPSS 0.2%CVE-2026-120646—CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfoEPSS 0.2%CVE-2025-43236LOWA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VeEPSS 0.2%CVE-2025-8354HIGHRFA File Parsing Type Confusion VulnerabilityEPSS 0.2%CVE-2026-11785MEDIUM389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handlerEPSS 0.2%CVE-2026-65409MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, mEPSS 0.2%CVE-2026-27298HIGHAdobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)EPSS 0.2%CVE-2026-18417MEDIUMWild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous errorEPSS 0.2%CVE-2026-77237HIGHMissing type validation in xQueueAddToSet in FreeRTOS-KernelEPSS 0.2%CVE-2026-39956MEDIUMjq: Missing runtime type checks for _strindices lead to crash and limited memory disclosureEPSS 0.2%CVE-2026-8554LOWType Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-57254HIGHFoxit PDF Editor/Reader Annotation Type Confusion VulnerabilityEPSS 0.2%CVE-2024-40676HIGHIn checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to aEPSS 0.2%CVE-2026-20508MEDIUMIn Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicEPSS 0.2%CVE-2026-112550MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macEPSS 0.2%CVE-2024-58253LOWIn the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversionEPSS 0.2%CVE-2026-5914HIGHType Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to pEPSS 0.2%