Common Weakness Enumeration

CWE-843

Weakness Allowed

Access of Resource Using Incompatible Type

Abstraction: Base · Status: Incomplete

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-704 · View CWE-1000

ChildOf: CWE-704 · View CWE-1003

CanPrecede: CWE-119 · View CWE-1000

Modes of introduction

Implementation

This weakness is not unique to C and C++. While it is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.

Detection methods

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Notes

Applicable Platform

This weakness is possible in any type-unsafe programming language.

Research Gap

Type confusion weaknesses have received some attention by applied researchers and major software vendors for C and C++ code. Some publicly-reported vulnerabilities probably have type confusion as a root-cause weakness, but these may be described as "memory corruption" instead.

For other languages, there are very few public reports of type confusion weaknesses. These are probably under-studied. Since many programs rely directly or indirectly on loose typing, a potential "type confusion" behavior might be intentional, possibly requiring more manual analysis.

Content history

Submission: CWE Content Team · MITRE · 2011-05-15 · CWE 1.13

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated References

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Applicable_Platforms, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2019-01-03 · CWE 3.2

updated Relationships

Modification: CWE Content Team · MITRE · 2019-06-20 · CWE 3.3

updated Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2020-06-25 · CWE 4.1

updated Common_Consequences, Relationships

Modification: CWE Content Team · MITRE · 2022-04-28 · CWE 4.7

updated Research_Gaps

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated References, Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2023-10-26 · CWE 4.13

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Detection_Factors, Observed_Examples, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, Name, References, Relationships, Taxonomy_Mappings

1393 vulnerabilities reference this CWE, most recent first.

CVE-2026-125116 (GCVE-0-2026-125116)

Vulnerability from cvelistv5 – Published: 2026-11-09 22:20 – Updated: 2026-11-09 22:20

Title

Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections

Summary

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

11 references

URL	Tags
https://github.com/Automattic/mongoose/security/a…	x_refsource_CONFIRM
https://github.com/Automattic/mongoose/commit/0ec…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/18a…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/390…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/8ce…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/b26…	x_refsource_MISC
https://github.com/Automattic/mongoose/commit/b68…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC
https://github.com/Automattic/mongoose/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Automattic	mongoose	Affected: < 6.13.12 Affected: >= 7.0.0, < 7.8.13 Affected: >= 8.0.0, < 8.24.7 Affected: >= 9.0.0, < 9.11.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mongoose",
          "vendor": "Automattic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.13.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.8.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.24.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.11.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T22:20:28.483Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf"
        },
        {
          "name": "https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/6.13.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/6.13.12"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/7.8.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/7.8.13"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/8.24.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/8.24.7"
        },
        {
          "name": "https://github.com/Automattic/mongoose/releases/tag/9.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Automattic/mongoose/releases/tag/9.11.4"
        }
      ],
      "source": {
        "advisory": "GHSA-wr5m-5jph-8m96",
        "discovery": "UNKNOWN"
      },
      "title": "Mongoose: Discriminator key values matching inherited properties (e.g. __t: \u0027constructor\u0027) bypass schema casting and can poison collections"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125116",
    "datePublished": "2026-11-09T22:20:28.483Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-09T22:20:28.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124031 (GCVE-0-2026-124031)

Vulnerability from cvelistv5 – Published: 2026-11-06 19:14 – Updated: 2026-11-09 22:43

Title

GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4

Summary

GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:38 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7829 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/gpac/gpac/issues/4030	issue-tracking
https://github.com/gpac/gpac	product
https://github.com/gpac/gpac/commit/43a8329a90ae2…	patch
https://github.com/sigdevel/pocs/blob/main/res/gp…	exploit
https://github.com/gpac/gpac/blob/v26.07.0/src/co…	technical-description
https://www.vulncheck.com/advisories/gpac-through…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gpac	gpac	Affected: 0 , ≤ 26.07.0 (custom) cpe:2.3:a:gpac:gpac::::::::

Date Public

2026-10-29 00:00

Credits

Alexander A. Shvedov (sigdevel)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124031",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:38:26.658661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:43:50.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gpac",
          "vendor": "gpac",
          "versions": [
            {
              "lessThanOrEqual": "26.07.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "26.07.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander A. Shvedov (sigdevel)"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape\u0027s appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T19:14:47.578Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #4030",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/gpac/gpac/issues/4030"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gpac/gpac"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gpac/gpac/commit/43a8329a90ae2907716b593cc3746458516c7c39"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/222/222_gf_node_get_tag_compositor_texturing_c_370.xmt"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/drawable.c#L564-L565"
        },
        {
          "name": "VulnCheck Advisory: GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gpac-through-26.07.0-type-confusion-via-drawable-get-aspect-2d-mpeg4"
        }
      ],
      "title": "GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124031",
    "datePublished": "2026-11-06T19:14:47.578Z",
    "dateReserved": "2026-11-06T18:53:06.456Z",
    "dateUpdated": "2026-11-09T22:43:50.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124030 (GCVE-0-2026-124030)

Vulnerability from cvelistv5 – Published: 2026-11-06 19:14 – Updated: 2026-11-10 20:06

Title

GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Summary

GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 20:05 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7829 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/gpac/gpac/issues/4032	issue-tracking
https://github.com/gpac/gpac	product
https://github.com/gpac/gpac/commit/1359c4da9329c…	patch
https://github.com/sigdevel/pocs/blob/main/res/gp…	exploit
https://github.com/gpac/gpac/blob/v26.07.0/src/sc…	technical-description
https://www.vulncheck.com/advisories/gpac-through…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gpac	gpac	Affected: 0 , ≤ 26.07.0 (custom) cpe:2.3:a:gpac:gpac::::::::

Date Public

2026-10-29 00:00

Credits

Alexander A. Shvedov (sigdevel)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124030",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T20:05:45.947868Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T20:06:01.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gpac",
          "vendor": "gpac",
          "versions": [
            {
              "lessThanOrEqual": "26.07.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "26.07.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexander A. Shvedov (sigdevel)"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T19:14:46.903Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #4032",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/gpac/gpac/issues/4032"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gpac/gpac"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gpac/gpac/commit/1359c4da9329cedceeb8fcfeab6d97e0927236e1"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/224/224_gf_sg_command_apply_scenegraph_commands_c_346.xmt"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/commands.c#L321"
        },
        {
          "name": "VulnCheck Advisory: GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gpac-through-26.07.0-type-confusion-via-gf-sg-command-apply-xmt-field-replace"
        }
      ],
      "title": "GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124030",
    "datePublished": "2026-11-06T19:14:46.903Z",
    "dateReserved": "2026-11-06T18:53:06.106Z",
    "dateUpdated": "2026-11-10T20:06:01.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120646 (GCVE-0-2026-120646)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:40 – Updated: 2026-11-09 19:36

Title

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo

Summary

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 19:36 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 61/100 over 355 records in the last 180 days details

References

3 references

URL	Tags
https://metacpan.org/release/LEEJO/CGI-4.72/sourc…	technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes	release-notes
https://github.com/leejo/CGI.pm/commit/a14a7decfd…	patch

Impacted products

1 product

Vendor	Product	Version
		Affected: 4.71 , < 5.00 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-120646",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T19:36:04.858365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T19:36:34.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "CGI"
          ],
          "packageName": "CGI",
          "packageURL": "pkg:cpan/CGI",
          "programFiles": [
            "lib/CGI.pm"
          ],
          "programRoutines": [
            {
              "name": "CGI::uploadInfo"
            }
          ],
          "repo": "https://github.com/leejo/CGI.pm",
          "versions": [
            {
              "lessThan": "5.00",
              "status": "affected",
              "version": "4.71",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo.\n\nuploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:40:59.008Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/a14a7decfdc18f2daf436d30df9b543e3f0f8da3.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to CGI 5.00 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-120646",
    "datePublished": "2026-11-03T23:40:59.008Z",
    "dateReserved": "2026-11-02T17:45:12.662Z",
    "dateUpdated": "2026-11-09T19:36:34.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120151 (GCVE-0-2026-120151)

Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 14:15

Title

PostgreSQL plpgsql record-field type confusion executes arbitrary code

Summary

Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.7 (rpm) Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm)

Credits

The PostgreSQL project thanks Claude and Ada Logics for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.7",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.12",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.16",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.20",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.25",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable\u0027s row type while a value is being cast.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T14:15:27.877Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-120151/"
        }
      ],
      "title": "PostgreSQL plpgsql record-field type confusion executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-120151",
    "datePublished": "2026-11-12T14:15:27.877Z",
    "dateReserved": "2026-10-30T22:45:08.383Z",
    "dateUpdated": "2026-11-12T14:15:27.877Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120148 (GCVE-0-2026-120148)

Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 14:15

Title

PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code

Summary

Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.7 (rpm) Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm)

Credits

The PostgreSQL project thanks Mehmet D. INCE for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.7",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.12",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.16",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.20",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.25",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T14:15:25.724Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-120148/"
        }
      ],
      "title": "PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-120148",
    "datePublished": "2026-11-12T14:15:25.724Z",
    "dateReserved": "2026-10-30T22:45:08.383Z",
    "dateUpdated": "2026-11-12T14:15:25.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120144 (GCVE-0-2026-120144)

Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 14:15

Title

PostgreSQL type-cache invalidation gap executes arbitrary code

Summary

Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.7 (rpm)

Credits

The PostgreSQL project thanks Peter Geoghegan for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.7",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T14:15:23.436Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-120144/"
        }
      ],
      "title": "PostgreSQL type-cache invalidation gap executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-120144",
    "datePublished": "2026-11-12T14:15:23.436Z",
    "dateReserved": "2026-10-30T22:45:08.383Z",
    "dateUpdated": "2026-11-12T14:15:23.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120142 (GCVE-0-2026-120142)

Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 14:15

Title

PostgreSQL dropped-column type confusion executes arbitrary code

Summary

Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.7 (rpm) Affected: 17 , < 17.12 (rpm)

Credits

The PostgreSQL project thanks Peter Geoghegan for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.7",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.12",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T14:15:22.150Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-120142/"
        }
      ],
      "title": "PostgreSQL dropped-column type confusion executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-120142",
    "datePublished": "2026-11-12T14:15:22.150Z",
    "dateReserved": "2026-10-30T22:45:08.382Z",
    "dateUpdated": "2026-11-12T14:15:22.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120141 (GCVE-0-2026-120141)

Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 14:15

Title

PostgreSQL materialized set-returning function type confusion executes arbitrary code

Summary

Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.7 (rpm) Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm)

Credits

The PostgreSQL project thanks Peter Geoghegan for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.7",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.12",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.16",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.20",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.25",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types.  json_populate_recordset() is one affected function.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T14:15:21.515Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-120141/"
        }
      ],
      "title": "PostgreSQL materialized set-returning function type confusion executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-120141",
    "datePublished": "2026-11-12T14:15:21.515Z",
    "dateReserved": "2026-10-30T22:45:08.382Z",
    "dateUpdated": "2026-11-12T14:15:21.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119993 (GCVE-0-2026-119993)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:25 – Updated: 2026-11-11 17:20

Title

Microsoft Office Outlook Information Disclosure Vulnerability

Summary

Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 18:48 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
CWE-822 - Untrusted Pointer Dereference

Assigner

microsoft CNA under the mitre root

CNA scorecard B 82/100 over 4930 records in the last 180 days details

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch

Impacted products

3 products

Vendor	Product	Version
Microsoft	Microsoft 365 Apps for Enterprise	Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)
Microsoft	Microsoft Office LTSC 2021	Affected: 16.0.1 , < 16.0.14334.21048 (custom)
Microsoft	Microsoft Office LTSC 2024	Affected: 16.0.0 , < 16.0.17932.21140 (custom)

Date Public

2026-11-10 16:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119993",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:48:26.370587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T18:57:27.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft 365 Apps for Enterprise",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2021",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.14334.21048",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office LTSC 2024",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.17932.21140",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.14334.21048",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*",
                  "versionEndExcluding": "16.0.17932.21140",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Access of resource using incompatible type (\u0027type confusion\u0027) in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en-US",
              "type": "CWE"
            },
            {
              "cweId": "CWE-822",
              "description": "CWE-822: Untrusted Pointer Dereference",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T17:20:45.899Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Office Outlook Information Disclosure Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119993"
        }
      ],
      "title": "Microsoft Office Outlook Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-119993",
    "datePublished": "2026-11-10T18:25:06.709Z",
    "dateReserved": "2026-10-30T17:58:13.877Z",
    "dateUpdated": "2026-11-11T17:20:45.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list