CWE-843— Access of Resource Using Incompatible Type (Type Confusion)

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.— MITRE CWE catalog

842 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-843page 3 of 17

CVE-2018-8133HIGHCVSS 7.5EG 8.1
2018-05-09
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. T…
CVE-2018-8229HIGHCVSS 7.5EG 8.6
2018-06-14
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. T…
CVE-2018-8279HIGHCVSS 7.5EG 8.6
2018-07-11
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8125…
CVE-2018-8291HIGHCVSS 7.5EG 8.6
2018-07-11
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft …
CVE-2018-8298CRITICALCVSS 7.5EG 9.0⚠ KEV
2018-07-11
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-82…
CVE-2018-8384HIGHCVSS 7.5EG 8.4
2018-08-15
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is un…
CVE-2018-9339HIGHCVSS 7.8EG 7.8
2024-11-19
In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…
CVE-2018-9471CRITICALCVSS 7.8EG 9.8
2024-11-20
In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User in…
CVE-2019-0752CRITICALCVSS 7.5EG 9.0⚠ KEV
2019-04-09
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-07…
CVE-2019-0810HIGHCVSS 7.5EG 7.5
2019-04-09
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, …
CVE-2019-0920MEDIUMCVSS 4.3EG 4.3
2019-06-12
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context…
CVE-2019-0988HIGHCVSS 7.5EG 7.5
2019-06-12
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context…
CVE-2019-10231CRITICALCVSS 9.8EG 9.8
2019-03-27
Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword() (inc/auth.class.php).
CVE-2019-10980HIGHCVSS 7.8EG 7.8
2019-08-05
A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base sco…
CVE-2019-11706HIGHCVSS 7.5EG 7.5
2019-07-23
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1.
CVE-2019-11707CRITICALCVSS 8.8EG 9.0⚠ KEV
2019-07-23
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects F…
CVE-2019-11750MEDIUMCVSS 6.5EG 6.5
2019-09-27
A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
CVE-2019-13118MEDIUMCVSS 5.3EG 5.3
2019-07-01
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack…
CVE-2019-13329HIGHCVSS 7.8EG 7.8
2019-10-03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicio…
CVE-2019-13330HIGHCVSS 7.8EG 7.8
2019-10-03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a…
CVE-2019-13519HIGHCVSS 7.8EG 7.8
2020-01-27
A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell…
CVE-2019-13730HIGHCVSS 8.8EG 8.8
2019-12-10
Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2019-13764HIGHCVSS 8.8EG 8.8
2019-12-10
Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2019-14537CRITICALCVSS 9.8EG 9.8
2019-08-07
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
CVE-2019-15792HIGHCVSS 7.1EG 7.1
2020-04-24
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), then without further checks passes the resulting file* into shiftfs_real_fdget(), w…
CVE-2019-17017HIGHCVSS 8.8EG 8.8
2020-01-08
Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68…
CVE-2019-17026CRITICALCVSS 8.8EG 9.0⚠ KEV
2020-03-02
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird <…
CVE-2019-17639MEDIUMCVSS 5.3EG 5.3
2020-07-15
In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current meth…
CVE-2019-17675HIGHCVSS 8.8EG 8.8
2019-10-17
WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
CVE-2019-19391CRITICALCVSS 9.1EG 9.1
2019-11-29
In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options…
CVE-2019-2047CRITICALCVSS 9.8EG 9.8
2019-05-08
In UpdateLoadElement of ic.cc, there is a possible out-of-bounds write due to type confusion. This could lead to remote code execution in the proxy auto-config with no additional execution privileges needed. User interaction is not needed …
CVE-2019-2052HIGHCVSS 7.5EG 7.5
2019-05-08
In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Pr…
CVE-2019-20571CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. There is type confusion in the WVDRM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14885 (September 2019).
CVE-2019-20583CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the EXT_FR Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14847 (August 2019).
CVE-2019-20584CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the HDCP Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14850 (August 2019).
CVE-2019-20585CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEC_FR Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14851 (August 2019).
CVE-2019-20586CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the FINGERPRINT Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14864 (August 2019).
CVE-2019-20587CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the MLDAP Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14867 (August 2019).
CVE-2019-20588CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14891 (August 2019).
CVE-2019-20589CRITICALCVSS 9.8EG 9.8
2020-03-24
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SKPM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14892 (August 2019).
CVE-2019-2097CRITICALCVSS 9.8EG 9.8
2019-06-07
In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion. This could lead to remote code execution from a malicious proxy configuration, with no additional execution privileges needed.…
CVE-2019-2130CRITICALCVSS 9.8EG 9.8
2019-08-20
In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed.…
CVE-2019-25010CRITICALCVSS 9.8EG 9.8
2020-12-31
An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
CVE-2019-5047HIGHCVSS 7.8EG 7.8
2019-10-09
An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a Use After Free. An attacker can craft a malicious PDF to trigger this…
CVE-2019-5183CRITICALCVSS 9.0EG 9.0
2020-01-25
An exploitable type confusion vulnerability exists in AMD ATIDXX64.DLL driver, versions 26.20.13031.10003, 26.20.13031.15006 and 26.20.13031.18002. A specially crafted pixel shader can cause a type confusion issue, leading to potential cod…
CVE-2019-5791HIGHCVSS 8.8EG 8.8
2019-05-23
Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVE-2019-5815HIGHCVSS 7.5EG 7.5
2019-12-11
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.
CVE-2019-6214HIGHCVSS 8.6EG 8.6
2019-03-05
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A malicious application may be able to break out of its sandbox.
CVE-2019-6215HIGHCVSS 8.8EG 8.8
2019-03-05
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to a…
CVE-2019-6532HIGHCVSS 7.8EG 7.8
2019-06-07
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote c…

Map vulnerabilities like CWE-843 to your infrastructure

EchelonGraph correlates every CVE — across CWE-843 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →