CWE-843 · Memory Corruption
Type Confusion
986CVEs
42exploited
0with a public check
37likely (EPSS 10%+)
SortMost likely exploited
986 CVEs with CWE-843 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2011-0611In CISA KEVExploitedAdobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLi…Adobe · Flash Player · CVSS 8.8 · 2011-04-13 | 8.8 | 99% | 2011-04-13 |
| CVE-2012-0507In CISA KEVExploitedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows r…Oracle · Java SE · CVSS 9.8 · 2012-06-07 | 9.8 | 98% | 2012-06-07 |
| CVE-2017-8291In CISA KEVExploitedArtifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps do…Artifex · Ghostscript · CVSS 7.8 · 2017-04-27 | 7.8 | 97% | 2017-04-27 |
| CVE-2021-21224In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2021-04-26 | 8.8 | 84% | 2021-04-26 |
| CVE-2019-0752In CISA KEVExploitedA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerabi…Microsoft · Internet Explorer 11 · CVSS 7.5 · 2019-04-09 | 7.5 | 82% | 2019-04-09 |
| CVE-2017-0037In CISA KEVExploitedMicrosoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in msh…Microsoft Corporation · Internet Browser · CVSS 8.1 · 2017-02-26 | 8.1 | 80% | 2017-02-26 |
| CVE-2016-7201In CISA KEVExploitedThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site,…Microsoft · Edge · CVSS 8.8 · 2016-11-10 | 8.8 | 80% | 2016-11-10 |
| CVE-2020-6418In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2020-02-27 | 8.8 | 79% | 2020-02-27 |
| CVE-2018-8298In CISA KEVExploitedA remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." Thi…Microsoft · ChakraCore · CVSS 7.5 · 2018-07-11 | 7.5 | 75% | 2018-07-11 |
| CVE-2021-30551In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2021-06-15 | 8.8 | 65% | 2021-06-15 |
| CVE-2020-16009In CISA KEVExploitedInappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2020-11-03 | 8.8 | 48% | 2020-11-03 |
| CVE-2019-17026In CISA KEVExploitedIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. Th…Mozilla · Firefox ESR · CVSS 8.8 · 2020-03-02 | 8.8 | 46% | 2020-03-02 |
| CVE-2024-38178In CISA KEVExploitedScripting Engine Memory Corruption VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 7.5 · 2024-08-13 | 7.5 | 41% | 2024-08-13 |
| CVE-2023-4762In CISA KEVExploitedType Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)Google · Chrome · CVSS 8.8 · 2023-09-05 | 8.8 | 41% | 2023-09-05 |
| CVE-2023-2033In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity…Google · Chrome · CVSS 8.8 · 2023-04-14 | 8.8 | 41% | 2023-04-14 |
| CVE-2019-11707In CISA KEVExploitedA type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks…Mozilla · Firefox ESR · CVSS 8.8 · 2019-07-23 | 8.8 | 38% | 2019-07-23 |
| CVE-2023-3079In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity…Google · Chrome · CVSS 8.8 · 2023-06-05 | 8.8 | 38% | 2023-06-05 |
| CVE-2017-5070In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a…Google · Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.9… · CVSS 8.8 · 2017-10-27 | 8.8 | 32% | 2017-10-27 |
| CVE-2025-30397In CISA KEVExploitedScripting Engine Memory Corruption VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.5 · 2025-05-13 | 7.5 | 27% | 2025-05-13 |
| CVE-2022-1096In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2022-07-22 | 8.8 | 25% | 2022-07-22 |
| CVE-2023-32439In CISA KEVExploitedA type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1.…Apple · iOS and iPadOS · CVSS 8.8 · 2023-06-23 | 8.8 | 24% | 2023-06-23 |
| CVE-2022-4262In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity:…Google · Chrome · CVSS 8.8 · 2022-12-02 | 8.8 | 24% | 2022-12-02 |
| CVE-2024-7971In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)Google · Chrome · CVSS 8.8 · 2024-08-21 | 8.8 | 21% | 2024-08-21 |
| CVE-2019-8506In CISA KEVExploitedA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Win…Apple · iOS · CVSS 8.8 · 2019-12-18 | 8.8 | 16% | 2019-12-18 |
| CVE-2024-4947In CISA KEVExploitedType Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security sever…Google · Chrome · CVSS 9.6 · 2024-05-15 | 9.6 | 15% | 2024-05-15 |
| CVE-2025-6554In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)Google · Chrome · CVSS 8.1 · 2025-06-30 | 8.1 | 14% | 2025-06-30 |
| CVE-2021-1789In CISA KEVExploitedA type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, t…Apple · iOS and iPadOS · CVSS 8.8 · 2021-04-02 | 8.8 | 14% | 2021-04-02 |
| CVE-2022-1364In CISA KEVExploitedType confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2022-07-26 | 8.8 | 14% | 2022-07-26 |
| CVE-2017-11292In CISA KEVExploitedAdobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index…Adobe · Adobe Flash Player version 27.0.0.159 and earlier · CVSS 8.8 · 2017-10-21 | 8.8 | 11% | 2017-10-21 |
| CVE-2024-23222In CISA KEVExploitedA type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3…Apple · Safari · CVSS 8.8 · 2024-01-23 | 8.8 | 11% | 2024-01-23 |
| CVE-2020-27932In CISA KEVExploitedA type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 Hi…Apple · watchOS · CVSS 7.8 · 2020-12-08 | 7.8 | 10% | 2020-12-08 |
| CVE-2023-23529In CISA KEVExploitedA type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Pr…Apple · iOS and iPadOS · CVSS 8.8 · 2023-02-27 | 8.8 | 9.5% | 2023-02-27 |
| CVE-2021-30563In CISA KEVExploitedType Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2021-08-03 | 8.8 | 9.5% | 2021-08-03 |
| CVE-2025-10585In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity…Google · Chrome · CVSS 8.8 · 2025-09-24 | 8.8 | 9.0% | 2025-09-24 |
| CVE-2022-42856In CISA KEVExploitedA type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Pro…Apple · tvOS · CVSS 8.8 · 2022-12-15 | 8.8 | 8.5% | 2022-12-15 |
| CVE-2022-3723In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity:…Google · Chrome · CVSS 8.8 · 2022-11-01 | 8.8 | 7.9% | 2022-11-01 |
| CVE-2024-5274In CISA KEVExploitedType Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security seve…Google · Chrome · CVSS 8.3 · 2024-05-28 | 8.3 | 7.7% | 2024-05-28 |
| CVE-2025-13223In CISA KEVExploitedType Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity…Google · Chrome · CVSS 8.8 · 2025-11-17 | 8.8 | 4.9% | 2025-11-17 |
| CVE-2021-30869In CISA KEVExploitedA type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catali…Apple · iOS and iPadOS · CVSS 7.8 · 2021-08-24 | 7.8 | 4.2% | 2021-08-24 |
| CVE-2026-21519In CISA KEVExploitedDesktop Window Manager Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-02-10 | 7.8 | 2.6% | 2026-02-10 |
| CVE-2022-41033In CISA KEVExploitedWindows COM+ Event System Service Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.8 · 2022-10-11 | 7.8 | 1.9% | 2022-10-11 |
| CVE-2026-85046In CISA KEVExploitedType confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sev…Google · Chrome · CVSS 8.8 · 2026-09-03 | 8.8 | 1.8% | 2026-09-03 |
| CVE-2020-1421A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vu…Microsoft · Windows 10 Version 2004 for 32-bit Systems · 2020-07-14 | – | 75% | 2020-07-14 |
| CVE-2018-8279A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsof…Microsoft · Microsoft Edge · 2018-07-11 | – | 71% | 2018-07-11 |
| CVE-2018-8229A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruptio…Microsoft · Microsoft Edge · 2018-06-14 | – | 71% | 2018-06-14 |
| CVE-2018-8291A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability…Microsoft · ChakraCore · 2018-07-11 | – | 69% | 2018-07-11 |
| CVE-2023-0286X.400 address type confusion in X.509 GeneralNameOpenSSL · OpenSSL · CVSS 7.4 · 2023-02-08 | 7.4 | 68% | 2023-02-08 |
| CVE-2024-6119Possible denial of service in X.509 name checksOpenSSL · OpenSSL · CVSS 7.5 · 2024-09-03 | 7.5 | 67% | 2024-09-03 |
| CVE-2018-8384A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruptio…Microsoft · ChakraCore · 2018-08-15 | – | 64% | 2018-08-15 |
| CVE-2023-34967Samba: type confusion in mdssvc rpc service for spotlightRed Hat · Red Hat Enterprise Linux 8 · CVSS 5.3 · 2023-07-20 | 5.3 | 61% | 2023-07-20 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.