This vulnerability occurs when a program calls a function or method but passes an argument of the wrong data type, which can cause unexpected behavior or security flaws.
This issue is most common in loosely typed languages like JavaScript or PHP, where the language doesn't enforce strict type checks at runtime. It can also happen in strongly typed languages when using features like variable argument lists or implicit type conversions, where the compiler cannot catch the mismatch before the code runs. When a function receives a type it doesn't expect—like a string instead of a number—it may crash, produce incorrect results, or trigger other weaknesses like buffer overflows or injection flaws. Developers should use explicit type checking, validation, and modern language features (like TypeScript or strict mode) to prevent these errors.
Impact: Quality Degradation