cve.bz

CWE-843: Access of Resource Using Incompatible Type (Type Confusion), page 4

Filter

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

What the weakness is: CWE-843 at MITRE

Ask an AI about CWE-843

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-843: Access of Resource Using Incompatible Type and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/843.html and https://cve.bz/cve/cwe/843?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-74956EPSS 0.5%

    Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  2. 8.8CVE-2026-16239EPSS 0.7%

    Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL…

  3. 8.8CVE-2026-16238EPSS 0.4%

    Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor …

  4. 8.8CVE-2026-14680EPSS 0.4%

    Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class …

  5. 8.8CVE-2026-14671EPSS 0.4%

    Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git reposi…

  6. 8.1CVE-2026-14668EPSS 0.3%

    Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculat…

  7. 5.4CVE-2026-70339EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  8. 7.1CVE-2026-18701EPSS 0.4%

    An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of servi…

  9. 7.8CVE-2026-68811EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  10. 7.8CVE-2026-68803EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  11. 8.8CVE-2026-65807EPSS 0.8%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  12. 7.8CVE-2026-64904EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

  13. 7.8CVE-2026-61932EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

  14. 8.2CVE-2026-72766EPSS 0.4%

    n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow…

  15. 8.6CVE-2026-14644EPSS 0.6%

    Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administra…

  16. 9.8CVE-2026-71558EPSS 1.0%

    Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer dese…

  17. 8.8CVE-2026-15572EPSS 0.7%

    A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type dur…

  18. 9.6CVE-2026-66321EPSS 1.1%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  19. 8.8CVE-2026-17989EPSS 0.5%

    Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

  20. 7.5CVE-2026-17948EPSS 0.3%

    Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: …

  21. 5.8CVE-2026-17866EPSS 0.2%

    Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Mediu…

  22. 8.8CVE-2026-17725EPSS 0.5%

    Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  23. 9.6CVE-2026-17697EPSS 0.5%

    Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  24. 9.6CVE-2026-17687EPSS 0.6%

    Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  25. 9.8CVE-2026-64727EPSS 0.5%

    A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.6, tvOS 26.6. An app may be able to cause unexpected system termination.

  26. 9.8CVE-2026-64704EPSS 0.6%

    A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

  27. 5.5CVE-2026-64693EPSS 0.2%

    A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6…

  28. 7.1CVE-2026-13066EPSS 0.4%

    Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended inform…

  29. 8.8CVE-2026-16420EPSS 0.6%

    Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  30. 9.8CVE-2026-16410EPSS 0.6%

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  31. 9.1CVE-2026-16392EPSS 0.5%

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  32. 9.8CVE-2026-16363EPSS 0.6%

    JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  33. 9.8CVE-2026-16355EPSS 0.6%

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  34. 9.8CVE-2026-64608EPSS 0.8%

    Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input w…

  35. 8.8CVE-2026-15776EPSS 0.5%

    Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  36. 7.8CVE-2026-58541EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to elevate privileges locally.

  37. 7.5CVE-2026-57108EPSS 1.2%

    Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

  38. 7.8CVE-2026-55025EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  39. 7.8CVE-2026-55024EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  40. 7.8CVE-2026-55022EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

  41. 6.5CVE-2026-54116EPSS 1.0%

    Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.

  42. 8.1CVE-2026-50686EPSS 0.7%

    Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.

  43. 7.8CVE-2026-50491EPSS 0.3%

    Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.

  44. 7.8CVE-2026-50421EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

  45. 7.8CVE-2026-50390EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Windows Kernel allows an authorized attacker to elevate privileges locally.

  46. 5.5CVE-2026-50381EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.

  47. 8.8CVE-2026-55771EPSS 0.6%

    CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to inco…

  48. 8.8CVE-2026-55772EPSS 0.5%

    CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Reco…

  49. 6.1CVE-2026-58305EPSS 0.2%

    Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.

  50. 7.8CVE-2026-57254EPSS 0.2%

    There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash.