Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

CVEs (1,003)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-64704 1Apple 1Macos Oct 24, 2026 Jul 27, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
CVE-2026-64693 1Apple 6Ipados Iphone OsMacos+3 more Aug 17, 2026 Jul 27, 2026 N/A· v4 5.5 MEDIUM· v3 N/A· v2 A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS...Show more A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted image may lead to a denial-of-service.Show less
CVE-2026-13066 1Mongodb 1Mongodb Oct 24, 2026 Jul 22, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes a...Show more Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.Show less
CVE-2026-16420 1Google 1Chrome Oct 24, 2026 Jul 21, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-16410 1Mozilla 2Firefox Thunderbird Oct 24, 2026 Jul 21, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16392 1Mozilla 2Firefox Thunderbird Oct 24, 2026 Jul 21, 2026 N/A· v4 9.1 CRITICAL· v3 N/A· v2 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16363 1Mozilla 2Firefox Thunderbird Oct 24, 2026 Jul 21, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16355 1Mozilla 2Firefox Thunderbird Oct 24, 2026 Jul 21, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-64608 1Apache 1Fory Oct 24, 2026 Jul 21, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actu...Show more Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.Show less
CVE-2026-15776 1Google 1Chrome Oct 24, 2026 Jul 14, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-58541 1Microsoft 11Windows 10 1607 Windows 10 1809Windows 10 21h2+8 more Jul 16, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to elevate privileges locally.
CVE-2026-57108 1Microsoft 1.net Jul 20, 2026 Jul 14, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-55025 1Microsoft 7365 Apps ExcelMicrosoft 365+4 more Jul 15, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-55024 1Microsoft 7365 Apps ExcelMicrosoft 365+4 more Jul 15, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-55022 1Microsoft 6365 Apps Microsoft 365Office 2016+3 more Jul 16, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-54116 1Microsoft 1Sql Server 2025 Jul 22, 2026 Jul 14, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-50686 1Microsoft 12Windows 10 1607 Windows 10 1809Windows 10 21h2+9 more Jul 23, 2026 Jul 14, 2026 N/A· v4 8.1 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network.
CVE-2026-50491 1Microsoft 12Windows 10 1607 Windows 10 1809Windows 10 21h2+9 more Jul 23, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.
CVE-2026-50421 1Microsoft 11Windows 10 1607 Windows 10 1809Windows 10 21h2+8 more Jul 23, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
CVE-2026-50390 1Microsoft 12Windows 10 1607 Windows 10 1809Windows 10 21h2+9 more Oct 14, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Windows Kernel allows an authorized attacker to elevate privileges locally.

Previous 1...8910...51 Next