Type Confusion Detection
Detection Workflow
- Identify type operations: Find all type casts, virtual function calls, union usage, class hierarchies
- Analyze type safety: Check cast validation, assess vtable integrity, verify union usage correctness
- Trace object flow: Use
xrefs_to to trace objects, identify type changes, assess type consistency
- Assess exploitability: Can attacker control object type? Is there useful type confusion? Can attacker corrupt vtable?
Key Patterns
- Unsafe type casting: C-style casts without validation, reinterpret_cast without checks
- Vtable corruption: virtual function calls on corrupted objects, vtable pointer manipulation
- Union misuse: writing to one union member, reading another
- Polymorphism issues: base pointer used as derived without dynamic_cast
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, cast operation, base type, derived type, validation, vtable access, exploitability, attack scenario, impact, mitigation.
Severity Guidelines
- CRITICAL: Type confusion with code execution
- HIGH: Type confusion with data corruption
- MEDIUM: Type confusion with limited impact
- LOW: Type confusion with minor issues
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
1---2name: detecting-type-confusion3description: Detects type confusion vulnerabilities by identifying unsafe type casts, vtable corruption, and polymorphism issues. Use when analyzing object-oriented code, type casting, or investigating C++ memory safety issues. Use when this capability is needed.4---56# Type Confusion Detection78## Detection Workflow9101. **Identify type operations**: Find all type casts, virtual function calls, union usage, class hierarchies112. **Analyze type safety**: Check cast validation, assess vtable integrity, verify union usage correctness123. **Trace object flow**: Use `xrefs_to` to trace objects, identify type changes, assess type consistency134. **Assess exploitability**: Can attacker control object type? Is there useful type confusion? Can attacker corrupt vtable?1415## Key Patterns1617- Unsafe type casting: C-style casts without validation, reinterpret_cast without checks18- Vtable corruption: virtual function calls on corrupted objects, vtable pointer manipulation19- Union misuse: writing to one union member, reading another20- Polymorphism issues: base pointer used as derived without dynamic_cast2122## Output Format2324Report with: id, type, subtype, severity, confidence, location, vulnerability, cast operation, base type, derived type, validation, vtable access, exploitability, attack scenario, impact, mitigation.2526## Severity Guidelines2728- **CRITICAL**: Type confusion with code execution29- **HIGH**: Type confusion with data corruption30- **MEDIUM**: Type confusion with limited impact31- **LOW**: Type confusion with minor issues3233## See Also3435- `patterns.md` - Detailed detection patterns and exploitation scenarios36- `examples.md` - Example analysis cases and code samples37- `references.md` - CWE references and mitigation strategies3839---40> Converted and distributed by [TomeVault](https://tomevault.io/claim/waiwai24) — claim your Tome and manage your conversions.41<!-- tomevault:4.0:skill_md:2026-04-13 -->
tomevault-io