CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access. While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.

Consequences

• Availability, Integrity, Confidentiality: Read Memory, Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart

Recent advisories

• GHSA-9pvw-hwfg-92h5 — Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
• GHSA-897f-g5gm-fmxm — Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
• GHSA-8r5x-fm3f-whwj — Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
• GHSA-r9w8-h9r3-54w4 — devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
• GHSA-j6r3-76f7-8jcv — ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
• CVE-2026-85046 — Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
• GHSA-32r8-5843-4qw2 — Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
• GHSA-2x35-3fw4-9jr4 — n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
• GHSA-rp2p-6cmp-jxj9 — Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
• GHSA-63wg-wjjj-7cp8 — Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update
• GHSA-3pv8-6f4r-ffg2 — tar has a PAX header desynchronization issue
• GHSA-fqw6-gf59-qr4w — containerd user ID handling bypass allows runAsNonRoot evasion
• GHSA-3cv2-h65g-fgmm — astral-tokio-tar has a PAX Header Desynchronization issue
• GHSA-fp55-jw48-c537 — astral-tokio-tar is Vulnerable to PAX Header Desynchronization
• GHSA-pfx2-9x9m-7ghx — OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean

All advisories for CWE-843