CWE-843 Access of Resource Using Incompatible Type

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

• Other: Varies by Context — When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. • Availability, Integrity, Confidentiality: Read Memory, Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart — If a memory buffer is accessed using an incompatible type, and the allocated buffer is smaller than the type that the code is attempting to access, then an attacker could read or write memory outside the bounds of the buffer, leading to a crash or possibly code execution.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2025-32352: Type confusion in PHP app allows authentication bypass when users have passwords whose MD5 hashes can be interpreted as numbers • CVE-2010-4577: Type confusion in CSS sequence leads to out-of-bounds read. • CVE-2011-0611: Size inconsistency allows code execution, first discovered when it was actively exploited in-the-wild. • CVE-2010-0258: Improperly-parsed file containing records of different types leads to code execution when a memory location is interpreted as a different object than intended.