cve.bz

CWE-843: Access of Resource Using Incompatible Type (Type Confusion), page 3

Filter

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

What the weakness is: CWE-843 at MITRE

Ask an AI about CWE-843

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-843: Access of Resource Using Incompatible Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/843.html and https://cve.bz/cve/cwe/843?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-71644EPSS 0.6%

    An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops pub…

  2. 9.1CVE-2026-45764EPSS 0.6%

    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Sur…

  3. 7.5CVE-2026-45762EPSS 0.6%

    Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker …

  4. 5.3CVE-2026-15461EPSS 0.2%

    The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_data match_data inside struct hl78xx_gnss_data. The generic NMEA0183 match help…

  5. 8.8CVE-2026-87636EPSS 0.5%

    Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  6. 8.8CVE-2026-87612EPSS 0.5%

    Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  7. 4.3CVE-2026-87564EPSS 0.3%

    Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  8. 9.6CVE-2026-87528EPSS 0.5%

    Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  9. 7.8CVE-2026-80161EPSS 0.3%

    Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to …

  10. 5.5CVE-2026-81401EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  11. 7.5CVE-2026-77890EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  12. 7.5CVE-2026-77889EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  13. 7.5CVE-2026-77888EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  14. 7.5CVE-2026-77499EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  15. 7.5CVE-2026-77494EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

  16. 6.5CVE-2026-72938EPSS 0.9%

    Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

  17. 7.8CVE-2026-70584EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows Core Messaging allows an authorized attacker to elevate privileges locally.

  18. 8.8CVE-2026-69717EPSS 0.8%

    Untrusted pointer dereference in Windows Group Policy allows an authorized attacker to elevate privileges over a network.

  19. 5.7CVE-2026-69679EPSS 0.6%

    Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

  20. 5.7CVE-2026-69637EPSS 0.6%

    Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over an adjacent network.

  21. 7.8CVE-2026-69324EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.

  22. 5.5CVE-2026-69308EPSS 0.4%

    Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally.

  23. 7.1CVE-2026-82057EPSS 0.4%

    A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collec…

  24. 6.7CVE-2026-20508EPSS 0.2%

    In Power HAL, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitati…

  25. 8.8CVE-2026-85051EPSS 0.5%

    Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  26. 8.8CVE-2026-85046KEVEPSS 1.8%

    Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  27. 6.3CVE-2026-53600EPSS 0.4%

    async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) in…

  28. 8.8CVE-2026-72984EPSS 0.8%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  29. 9.3CVE-2026-19315EPSS 0.7%

    A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

  30. 3.8CVE-2026-59304EPSS 0.2%

    Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

  31. 7.1CVE-2026-80183EPSS 0.4%

    In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/ro…

  32. 5.7CVE-2026-80185EPSS 0.3%

    BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local…

  33. 8.8CVE-2026-79236EPSS 0.5%

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  34. 8.8CVE-2026-79227EPSS 0.5%

    Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  35. 8.8CVE-2026-79209EPSS 0.5%

    Type confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  36. 8.3CVE-2026-79175EPSS 0.4%

    Type confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secur…

  37. 8.8CVE-2026-79045EPSS 0.4%

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  38. 8.8CVE-2026-78956EPSS 0.5%

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  39. 8.8CVE-2026-78938EPSS 0.5%

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  40. 8.8CVE-2026-78905EPSS 0.6%

    Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  41. 9.6CVE-2026-78904EPSS 0.6%

    Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  42. 8.7CVE-2026-79769EPSS 0.3%

    Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a …

  43. 8.2CVE-2026-77237EPSS 0.2%

    Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 to read privileged kernel memory. To remediate this issue, users s…

  44. 6.8CVE-2026-72844EPSS 0.2%

    The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being projected, and environment::add_inductive in src/kernel/inductive.cpp did not type check the nested inductive applica…

  45. 9.8CVE-2026-16919EPSS 0.8%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers.

  46. 8.8CVE-2026-76047EPSS 0.5%

    Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  47. 8.8CVE-2026-76038EPSS 0.5%

    Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  48. 7.5CVE-2026-52829EPSS 0.6%

    ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an…

  49. 9.8CVE-2026-59940EPSS 0.8%

    Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general d…

  50. 6.5CVE-2026-74976EPSS 0.4%

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.