CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

Extended Description

When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access. While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.

Code Examples & CVEs

Demonstrative Examples

The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.

The code intends to process the message as a NAME_TYPE, and sets the default message to "Hello World." However, since both buf.name and buf.nameID are part of the same union, they can act as aliases for the same memory location, depending on memory layout after compilation.

BadC

#define NAME_TYPE 1#define ID_TYPE 2                      struct MessageBuffer{int msgType;union {char *name;int nameID;};};                                            int main (int argc, char **argv) {                         struct MessageBuffer buf;char *defaultMessage = "Hello World";                            buf.msgType = NAME_TYPE;buf.name = defaultMessage;printf("Pointer of buf.name is %p\n", buf.name);                            /* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */                                                        buf.nameID = (int)(defaultMessage + 1);printf("Pointer of buf.name is now %p\n", buf.name);if (buf.msgType == NAME_TYPE) {printf("Message: %s\n", buf.name);}else {printf("Message: Use ID %d\n", buf.nameID);}                      }

The following PHP code accepts a value, adds 5, and prints the sum.

When called with the following query string:

BadPHP

$value = $_GET['value'];$sum = $value + 5;echo "value parameter is '$value'<p>";echo "SUM is $sum";

The following Perl code is intended to look up the privileges for user ID's between 0 and 3, by performing an access of the $UserPrivilegeArray reference. It is expected that only userID 3 is an admin (since this is listed in the third element of the array).

In this case, the programmer intended to use "$UserPrivilegeArray->{$userID}" to access the proper position in the array. But because the subscript was omitted, the "user" string was compared to the scalar representation of the $UserPrivilegeArray reference, which might be of the form "ARRAY(0x229e8)" or similar.

BadPerl

my $UserPrivilegeArray = ["user", "user", "admin", "user"];                      my $userID = get_current_user_ID();                      if ($UserPrivilegeArray eq "user") {print "Regular user!\n";}else {print "Admin!\n";}                      print "\$UserPrivilegeArray = $UserPrivilegeArray\n";

Observed CVE Examples (4)

CVE-2025-32352

Type confusion in PHP app allows authentication bypass when users have passwords whose MD5 hashes can be interpreted as numbers

View Details

CVE-2010-4577

Type confusion in CSS sequence leads to out-of-bounds read.

View Details

CVE-2011-0611

Size inconsistency allows code execution, first discovered when it was actively exploited in-the-wild.

View Details

CVE-2010-0258

Improperly-parsed file containing records of different types leads to code execution when a memory location is interpreted as a different object than intended.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine analysis methods around the CWE-843 resource boundary

MITRE identifies automated static analysis, manual source review, dynamic analysis as applicable detection approaches. Use them to trace casts, tagged unions, object lifetimes, deserialization boundaries, and foreign-function interfaces until the runtime object type is proven compatible with every operation performed on it. Require a reproducible trace from attacker influence to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.

CWE-843: detection methods and operational guidance — MITRE CWE

Enforce type-safe values across every API boundary

Require each function to return a valid object of its declared return type and leave every pointer-referenced output valid for the parameter type. Prefer typed interfaces over casts or untyped storage, preserve required representation invariants such as string termination, and use static type-mismatch checks at module boundaries where incompatible values can otherwise be interpreted as legitimate objects.

API07-C: Enforce type safety — Carnegie Mellon SEI

Apply lessons from CVE-2025-6554 in Google Chromium V8

NVD maps CVE-2025-6554 to CWE-843; a type-confusion flaw in the JavaScript and WebAssembly engine could permit arbitrary memory access through crafted web content. Use the case to fuzz optimization and deoptimization transitions, validate runtime type assumptions after speculative compilation, and run browser-facing tests under memory-safety instrumentation.

CVE-2025-6554 Detail — NIST National Vulnerability Database

Apply the C++ Core Guidelines type-safety profile

Use the type-safety rules to eliminate unchecked narrowing, unsafe unions, reinterpretation, and invalid downcasts. Prefer discriminated unions, typed interfaces, and checked conversions. Treat every escape from the static type system as a documented security boundary that requires an invariant, a narrow wrapper, focused review, and negative tests with incompatible runtime values.

C++ Core Guidelines: Type safety — Standard C++ Foundation

Exercise invalid runtime types with UndefinedBehaviorSanitizer

Enable vptr, object-size, alignment, bounds, and related UndefinedBehaviorSanitizer checks on supported C++ targets. Exercise downcasts, deserialized type tags, plugin boundaries, stale objects, malformed discriminators, and error paths. Preserve sanitizer diagnostics as regression cases, while also reviewing unexecuted casts and C-style type punning that runtime instrumentation may not reach.

UndefinedBehaviorSanitizer — LLVM Project

Frequently Asked Questions

What is CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')?+

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access. While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.

What are the security consequences of Access of Resource Using Incompatible Type ('Type Confusion')?+

If exploited, CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion')) it can compromise Availability, Integrity and Confidentiality, leading to outcomes such as Read Memory, Modify Memory, Execute Unauthorized Code or Commands and DoS: Crash, Exit, or Restart.

Which programming languages are affected by Access of Resource Using Incompatible Type ('Type Confusion')?+

CWE-843 commonly affects C and C++. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Access of Resource Using Incompatible Type ('Type Confusion')?+

MITRE documents real CVEs mapped to CWE-843, including CVE-2025-32352, CVE-2010-4577, CVE-2011-0611 and CVE-2010-0258. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-843 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (4)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine analysis methods around the CWE-843 resource boundary

Enforce type-safe values across every API boundary

Apply lessons from CVE-2025-6554 in Google Chromium V8

Apply the C++ Core Guidelines type-safety profile

Exercise invalid runtime types with UndefinedBehaviorSanitizer

Frequently Asked Questions

Learn More