Weakness (CWE)
CWE-843: Access of Resource Using Incompatible Type
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Source: MITRE CWE-843
865 results · Feed
-
High 7.5
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
-
High 7.5
Access of resource using incompatible type ('type confusion') in EPICS Base
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory…
-
High 8.1
JIT miscompilation in the JavaScript: WebAssembly component
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
High 7.3
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
High 8.8
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and…
-
High 7.5
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26…
-
High 7.5
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2…
-
Medium 4.3
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and i…
-
Medium 5.5
A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macO…
-
High 8.8
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and …
-
Medium 5.5
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may …
-
Medium 6.3CVE-2026-116370 Public exploit
2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The…
-
High 7.5
Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create…
-
Medium 6.3CVE-2026-116111 Public exploit
2K Games Civilization V Lua Sandbox loadstring type confusion
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly …
-
Medium 5.7
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, F…
-
Critical 9.9CVE-2026-115889 Public exploit
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with ma…
-
Low 3.7
Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the firs…
-
Low 2.9
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner ha…
-
Medium 6.5
Type confusion in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering…
-
High 8.8
Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the san…
-
High 8.8
Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arb…
-
High 8.8
Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the render…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside…
-
Medium 6.5
Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside…
-
Medium 6.5
Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute…
-
High 8.8
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadO…
-
Medium 5.4
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. …
-
Medium 6.5
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 b…
-
Medium 4.3
GlobalProtect App: Local Denial of Service (DoS) on Windows
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by th…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
.NET and Visual Studio Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
-
High 7.8
Windows StateRepository API Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
-
High 8.8
RPC Runtime Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.
-
Medium 5.5
Windows Device Association Service Information Disclosure Vulnerability
Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Input System Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows Portable Device File System Driver Information Disclosure Vulnerability
Access of resource using incompatible type ('type confusion') in Windows Portable Device File System Driver allows an authorized attacker to disclose information locally.
-
High 7.8
Windows SmartScreen Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
-
High 7.8
Desktop Window Manager Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.