CWE-843: Access of Resource Using Incompatible Type

When the later access type is incompatible with the type used for allocation or initialization, the program may misinterpret the resource's structure, size, or properties. If a memory buffer is accessed through a type larger than the allocated buffer, the access can extend beyond the buffer's bounds. The weakness can occur across different languages and data models, not only in C or C++ code involving casts or unions.

This weakness occurs when the same resource or memory location is interpreted through incompatible types, so the properties expected by the code do not match the actual data. It is often associated with unions and parsing data that contains multiple embedded object types in C, but it is not limited to C or C++; similar problems can arise when an application treats array parameters as scalars or vice versa, or when a language automatically converts a variable while it is accessed as another type. The record identifies C, C++, and Python as applicable languages, with prevalence undetermined.

The immediate result may be a logical error because the resource does not have the expected properties. If an allocated buffer is smaller than the incompatible type used to access it, an attacker may be able to read or modify memory outside the buffer, potentially causing a crash, unauthorized code or command execution, or impacts to confidentiality, integrity, and availability.

The official record does not specify mitigation guidance for this weakness.

Automated static analysis, commonly known as Static Application Security Testing (SAST), can detect some instances by analyzing source code or binary/compiled code without executing it. It typically builds data-flow and control-flow models, then searches for potentially vulnerable patterns connecting sources, where input originates, to sinks, where data interacts with external components or a lower layer such as the operating system. The official record rates this approach as highly effective, but it applies only to some instances of the weakness.

The following are representative examples, not an exhaustive list:

• CVE-2025-32352: Type confusion in a PHP application allows authentication bypass when users have passwords whose MD5 hashes can be interpreted as numbers.
• CVE-2010-4577: Type confusion in a CSS sequence leads to an out-of-bounds read.
• CVE-2011-0611: A size inconsistency leads to code execution; the issue was first discovered while it was being actively exploited in the wild.
• CVE-2010-0258: An improperly parsed file containing records of different types causes a memory location to be interpreted as an unintended object, leading to code execution.