← Back
CWE-843

904 CVEs • Abstraction: Base

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

JSON object

Loading...

CVEs (904)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Google
1Chrome
Jul 1, 2026
Jun 30, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
1Google
1Chrome
Jul 1, 2026
Jun 30, 2026
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Type Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral....Show more
Type Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Low)Show less
1Google
1Chrome
Jul 2, 2026
Jun 30, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
1Google
1Chrome
Jul 1, 2026
Jun 30, 2026
N/A· v4
9.6 CRITICAL· v3
N/A· v2
Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
1Google
1Chrome
Jul 2, 2026
Jun 30, 2026
N/A· v4
8.3 HIGH· v3
N/A· v2
Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...Show more
Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)Show less
1Google
1Chrome
Jul 2, 2026
Jun 30, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severi...Show more
Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)Show less
-
-
Jul 1, 2026
Jun 30, 2026
8.7 HIGH· v4
7.5 HIGH· v3
N/A· v2
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.
1Apple
4Ipados
Iphone OsMacos+1 more
Aug 17, 2026
Jun 29, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. P...Show more
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.Show less
1Azeotech
1Daqfactory
Jul 15, 2026
Jun 18, 2026
8.4 HIGH· v4
7.8 HIGH· v3
N/A· v2
In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.
1Google
1Android
Jun 17, 2026
Jun 16, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed...Show more
In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Show less
1Mozilla
2Firefox
Thunderbird
Jul 15, 2026
Jun 16, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
1Mozilla
2Firefox
Thunderbird
Jul 15, 2026
Jun 16, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
-
-
Jun 17, 2026
Jun 15, 2026
5.4 MEDIUM· v4
N/A· v3
N/A· v2
LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one c...Show more
LibreOffice Calc can import tracked changes from a spreadsheet document. A heap buffer overflow existed when a document reused the same change identifier for two different kinds of change. The importer then treated one change object as a different, larger type and wrote past the end of its allocation. In fixed versions records with a duplicate identifier are rejected.Show less
-
-
Jun 17, 2026
Jun 15, 2026
5.4 MEDIUM· v4
N/A· v3
N/A· v2
LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at t...Show more
LibreOffice can import documents in the OOXML format (DOCX). A heap buffer overflow existed when replaying deferred parser events for a text box element. A handler object was assumed to be of one type and written to at that type's field layout, but it could be a smaller object, so the write landed past the end of the allocation. In fixed versions the type is checked before the write.Show less
1Microsoft
8Windows 10 21h2
Windows 10 22h2Windows 11 23h2+5 more
Jul 9, 2026
Jun 9, 2026
N/A· v4
7.8 HIGH· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker to execute code locally.
1Microsoft
13Windows 10 1607
Windows 10 1809Windows 10 21h2+10 more
Jul 9, 2026
Jun 9, 2026
N/A· v4
8.1 HIGH· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.
1Microsoft
4Windows 11 24h2
Windows 11 25h2Windows 11 26h1+1 more
Jun 17, 2026
Jun 9, 2026
N/A· v4
7.8 HIGH· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
1Microsoft
7365 Apps
Microsoft 365Office 2016+4 more
Jun 19, 2026
Jun 9, 2026
N/A· v4
8.4 HIGH· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
1Microsoft
7365 Apps
ExcelMicrosoft 365+4 more
Jul 9, 2026
Jun 9, 2026
N/A· v4
7.8 HIGH· v3
N/A· v2
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
1Redhat
3389 Directory Server
Directory ServerEnterprise Linux
Jun 30, 2026
Jun 9, 2026
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.