CWE-843: Type Confusion
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Also known as Access of Resource Using Incompatible Type, Object Type Confusion.
A kind of CWE-704 Incorrect Type Conversion or Cast.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a...7.5 High
- google chromeType Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote...5.8 Medium
- google chromeType Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute...8.8 High
- google chromeType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to...9.6 Critical
- google chromeType Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had...9.6 Critical
- apple macos, tvos +1 moreA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS...9.8 Critical
- apple macosA type confusion issue was addressed with improved memory handling. This issue is fixed in macOS...9.8 Critical
- apple ipados, macos, tvos +4 more +6 moreA type confusion issue was addressed with improved checks. This issue is fixed in iOS 26.6 and...5.5 Medium
- lxsmnsyc serovalSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization9.8 Critical
- n8nn8n before 1.123.67 Arbitrary File Read via Send Email Node8.2 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreServer-Side JavaScript DBPointer BSON Serialization Memory Disclosure7.1 High
- google chromeType Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to...8.8 High
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript Engine: JIT component9.8 Critical
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript Engine: JIT component9.1 Critical
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript Engine: JIT component9.8 Critical
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript: WebAssembly component9.8 Critical
- apache foryApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths9.8 Critical
- google chromeInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote...8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreMicrosoft DWM Core Library Elevation of Privilege Vulnerability7.8 High
- microsoft sql server 2025 (cu 6), sql server 2025 for x64-based systems (gdr), sql server 2025 +2 moreMicrosoft SQL Server Information Disclosure Vulnerability6.5 Medium
- microsoft excel, 365 apps, 365 apps for enterprise +11 more +13 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft 365 apps, 365 apps for enterprise, office 2016 +9 more +11 moreMicrosoft Office Remote Code Execution Vulnerability7.8 High
- microsoft excel, 365 apps, 365 apps for enterprise +11 more +13 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +21 more +23 moreWindows OLE Remote Code Execution Vulnerability8.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreCode Integrity DLL (ci.dll) Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreWindows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Kernel Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 +10 more +12 moreComposite Image File System driver (cimfs.sys) Information Disclosure Vulnerability5.5 Medium
- cedar-policy cedar-javaCedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities8.8 High
- samsung open source escargotAccess of resource using incompatible type ('type confusion') vulnerability in Samsung Open...6.1 Medium
- dignifiedquire async-tarasync-tar PAX extension-header desync enables tar entry/content smuggling6.3 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader Annotation Type Confusion Vulnerability7.8 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability8.3 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability7.5 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability9.0 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.3 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability8.1 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability7.5 High
- zcashfoundation zebraZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book7.5 High
- google chromeType Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute...8.8 High
- google chromeType Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to...9.6 Critical
- ladybirdLadybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration8.9 High
- api-platform coreAPI Platform Core: Missing IRI type check enables resource type confusion6.5 Medium
- bps html::gumboHTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion9.8 Critical
- google chromeType Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain...6.5 Medium
- google chromeType Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an...6.5 Medium
- google chromeHeap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to...8.8 High
- google chromeType Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to...9.6 Critical
- google chromeType Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker...8.3 High
- google chromeType Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had...9.8 Critical
- Show moreLoading…