CWE-843— Access of Resource Using Incompatible Type (Type Confusion)
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.— MITRE CWE catalog
1,056 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-843page 15 of 22
- CVE-2021-28468HIGHCVSS 7.8EG 7.82021-04-13
Raw Image Extension Remote Code Execution Vulnerability
- CVE-2020-27257HIGHCVSS 7.8EG 7.82021-02-09
This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices.
- CVE-2021-25177HIGHCVSS 7.8EG 7.82021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Confusion issue exists when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service at…
- CVE-2020-27293HIGHCVSS 7.8EG 7.82021-01-11
Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attacker to execute arbitrary code.
- CVE-2020-15638HIGHCVSS 7.8EG 7.82020-08-20
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-16229HIGHCVSS 7.8EG 7.82020-08-06
Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a type confusion condition, which may allow remote code execution, disclosu…
- CVE-2020-0226HIGHCVSS 7.8EG 7.82020-07-17
In createWithSurfaceParent of Client.cpp, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege in the graphics server with no additional execution privileges needed. User interacti…
- CVE-2020-9261HIGHCVSS 7.8EG 7.82020-07-06
HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a type confusion vulnerability. The system does not properly check and transform the type of certain variable, the attacker tricks the user into installing then running…
- CVE-2019-8250HIGHCVSS 7.8EG 7.82020-07-06
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerabilit…
- CVE-2019-8249HIGHCVSS 7.8EG 7.82020-07-06
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerabilit…
- CVE-2020-10757HIGHCVSS 7.8EG 7.82020-06-09
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.
- CVE-2020-10913HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-10912HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-10911HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-10910HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-10909HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-10908HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-10891HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-10889HIGHCVSS 7.8EG 7.82020-04-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…
- CVE-2020-3853HIGHCVSS 7.8EG 7.82020-02-27
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to execute arbitrary code with…
- CVE-2019-13519HIGHCVSS 7.8EG 7.82020-01-27
A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in the limited exposure of information related to the targeted workstation. Rockwell…
- CVE-2019-5047HIGHCVSS 7.8EG 7.82019-10-09
An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a Use After Free. An attacker can craft a malicious PDF to trigger this…
- CVE-2019-13330HIGHCVSS 7.8EG 7.82019-10-03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a…
- CVE-2019-13329HIGHCVSS 7.8EG 7.82019-10-03
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicio…
- CVE-2019-10980HIGHCVSS 7.8EG 7.82019-08-05
A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base sco…
- CVE-2019-6532HIGHCVSS 7.8EG 7.82019-06-07
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote c…
- CVE-2018-19027HIGHCVSS 7.8EG 7.82019-01-30
Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the…
- CVE-2018-7530HIGHCVSS 7.8EG 7.82018-04-17
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server version…
- CVE-2017-16745HIGHCVSS 7.8EG 7.82018-03-15
A Type Confusion issue was discovered in Delta Electronics Delta Industrial Automation Screen Editor, Version 2.00.23.00 or prior. An access of resource using incompatible type ('type confusion') vulnerability may allow an attacker to exec…
- CVE-2017-15860HIGHCVSS 7.8EG 7.82018-02-23
In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur.
- CVE-2017-13220HIGHCVSS 7.8EG 7.82018-01-12
An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android kernel. Android ID: A-63527053.
- CVE-2025-7424HIGHCVSS 7.5EG 7.82025-07-10
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application o…
- CVE-2023-1077HIGHCVSS 7.0EG 7.82023-03-27
In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the…
- CVE-2022-25721HIGHCVSS 6.7EG 7.82023-01-09
Memory corruption in video driver due to type confusion error during video playback
- CVE-2014-1730HIGHCVSS v2 7.8EG 7.82014-04-26
Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by …
- CVE-2026-40683HIGHCVSS 7.7EG 7.72026-04-14
In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to a boolean when the user_enabled_invert configuration option is False (the default). The _ldap_res_to_model method in the UserApi …
- CVE-2024-40676HIGHCVSS 7.7EG 7.72025-01-28
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. This could lead to local escalation of privilege with no additional execution pri…
- CVE-2026-114598HIGHCVSS 7.5EG 7.52026-10-27
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could ex…
- CVE-2026-86974HIGHCVSS 7.5EG 7.52026-10-26
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may le…
- CVE-2026-116489HIGHCVSS 7.5EG 7.52026-10-26
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale s…
- CVE-2026-107911HIGHCVSS 7.5EG 7.52026-10-09
A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corru…
- CVE-2026-16111HIGHCVSS 7.5EG 7.52026-10-08
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
- CVE-2026-85644HIGHCVSS 7.5EG 7.52026-09-28
XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it te…
- CVE-2026-88816HIGHCVSS 7.5EG 7.52026-09-28
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKe…
- CVE-2026-84563HIGHCVSS 7.5EG 7.52026-09-14
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
- CVE-2026-45762HIGHCVSS 7.5EG 7.52026-09-10
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker …
- CVE-2026-77889HIGHCVSS 7.5EG 7.52026-09-08
Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
- CVE-2026-77890HIGHCVSS 7.5EG 7.52026-09-08
Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
- CVE-2026-77888HIGHCVSS 7.5EG 7.52026-09-08
Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
- CVE-2026-77499HIGHCVSS 7.5EG 7.52026-09-08
Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
Map vulnerabilities like CWE-843 to your infrastructure
EchelonGraph correlates every CVE — across CWE-843 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →