cve.bz

CWE-843: Access of Resource Using Incompatible Type (Type Confusion)

Filter

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

What the weakness is: CWE-843 at MITRE

Ask an AI about CWE-843

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-843: Access of Resource Using Incompatible Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/843.html and https://cve.bz/cve/cwe/843?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-20575

    In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID…

  2. –CVE-2026-20574

    In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID…

  3. –CVE-2026-20571

    In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID…

  4. 8.2CVE-2026-119086EPSS 0.2%

    Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized …

  5. 7.4CVE-2026-96187EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

  6. 5.4CVE-2026-88090EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

  7. 7.7CVE-2026-118510EPSS 0.3%

    A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on su…

  8. 7.5CVE-2026-62765EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  9. 8.8CVE-2026-85898EPSS 0.8%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  10. 8.7CVE-2026-114598EPSS 0.3%

    In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could ex…

  11. 8.8CVE-2026-112659EPSS 0.6%

    A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web conte…

  12. 5.5CVE-2026-112547EPSS 0.1%

    A type confusion issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.

  13. 2.1CVE-2026-116370EPSS 0.4%

    A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be ini…

  14. 7.7CVE-2026-116489EPSS 0.5%

    Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale s…

  15. 2.1CVE-2026-116111EPSS 0.3%

    A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploi…

  16. 5.7CVE-2026-115892EPSS 0.4%

    Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns …

  17. 9.9CVE-2026-115889EPSS 0.5%

    Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted W…

  18. 6.3CVE-2026-114115EPSS 0.3%

    Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner a…

  19. 8.8CVE-2026-113055EPSS 0.5%

    Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  20. 2.9CVE-2026-108518EPSS 0.3%

    DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from …

  21. 8.8CVE-2026-86922EPSS 0.3%

    A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.

  22. 5.4CVE-2026-86872EPSS 0.3%

    A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.

  23. 6.5CVE-2026-110674EPSS 0.5%

    Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte…

  24. 4.3CVE-2026-0314EPSS 0.10%

    A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS …

  25. 8.8CVE-2026-110140EPSS 0.3%

    Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  26. 5.5CVE-2026-96921EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally.

  27. 5.5CVE-2026-96854EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally.

  28. 7.8CVE-2026-85377EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.

  29. 7.8CVE-2026-83763EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.

  30. 5.5CVE-2026-83664EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows Portable Device File System Driver allows an authorized attacker to disclose information locally.

  31. 8.8CVE-2026-83642EPSS 0.9%

    Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.

  32. 7.8CVE-2026-70245EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-70225EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  34. 7.0CVE-2026-70205EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  35. 8.8CVE-2026-70167EPSS 1.0%

    Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.

  36. 7.8CVE-2026-70051EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.

  37. 5.5CVE-2026-70017EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.

  38. 7.8CVE-2026-69926EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

  39. 7.8CVE-2026-69880EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

  40. 8.8CVE-2026-102869EPSS 0.8%

    Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

  41. 7.8CVE-2026-102216EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

  42. 8.8CVE-2026-102203EPSS 0.9%

    Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.

  43. 5.5CVE-2026-79611EPSS 0.2%

    For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state t…

  44. 8.1CVE-2026-109733EPSS 0.5%

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  45. 7.1CVE-2026-109720EPSS 0.3%

    JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  46. 2.0CVE-2026-109282EPSS 0.1%

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An att…

  47. 5.1CVE-2026-108952EPSS 0.2%

    RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC de…

  48. 7.8CVE-2026-19575EPSS 0.1%

    The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). k_object_validate() short-circuits its type comparison w…

  49. 7.7CVE-2026-107911EPSS 0.4%

    A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corru…

  50. 8.7CVE-2026-106433EPSS 0.3%

    Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vaul…