Weaknesses of type CWE-1285

61 results

Validação inadequada de índice, posição ou deslocamento na entrada

A aplicação aceita um índice, posição ou offset fornecido pelo usuário sem validar se ele está dentro dos limites permitidos da estrutura de dados (array, string, buffer, etc.). Isso permite acesso a posições inválidas, causando leitura de dados sensíveis, corrupção de memória ou travamento do programa.

Example

Um API REST que retorna itens de uma lista permite passar um parâmetro ?offset=999999 sem verificar se existe dados naquela posição. Um atacante varre offsets arbitrários para ler dados de outros usuários ou causar erro de negação de serviço.

How to mitigate

Sempre validar que o índice/offset/posição está dentro do intervalo válido (0 até tamanho-1) antes de acessar. Use safeguards na linguagem (bounds checking automático quando disponível) e trate entradas suspeitas como erro, rejeitando-as ou retornando falha explícita.

CVE-2025-7849HIGHMemory Corruption Issue in NI LabVIEW due to improper error handlingEPSS 0.2%CVE-2024-0123LOWNVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker may cause an improperEPSS 0.2%CVE-2024-10494HIGHOut of bounds read in HeapObjMapImpl.cpp in NI LabVIEWEPSS 0.2%CVE-2024-10495HIGHOut of bounds read when loading the font table in fontmgr.cpp in NI LabVIEWEPSS 0.2%CVE-2024-10496HIGHOut of bounds read in BuildFontMap in fontmgr.cpp in NI LabVIEWEPSS 0.2%CVE-2026-12681HIGHImproper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does noEPSS 0.2%CVE-2019-25625MEDIUMBlob Studio 2.17 Denial of Service via Malformed InputEPSS 0.2%CVE-2019-25622MEDIUMPaint Studio 2.17 Denial of Service via Malformed InputEPSS 0.2%CVE-2024-36342HIGHImproper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execuEPSS 0.2%CVE-2019-25593MEDIUMjetCast Server 2.0 Denial of Service via Log DirectoryEPSS 0.2%CVE-2025-2633HIGHOut of Bounds Read Vulnerability in NI LabVIEW when loading fontsEPSS 0.2%CVE-2025-2634HIGHOut of Bounds Read Vulnerability in NI LabVIEW when building font mapEPSS 0.2%CVE-2026-18485HIGHLocal Privilege Escalation in NI-PALEPSS 0.1%CVE-2026-14479MEDIUMDenial of Service in Autodesk Installer IPC ChannelEPSS 0.1%CVE-2025-48511MEDIUMImproper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crEPSS 0.1%CVE-2025-48502MEDIUMImproper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial oEPSS 0.1%CVE-2026-8036HIGHLocal privilege escalation in NI-PALEPSS 0.1%CVE-2026-20413MEDIUMIn imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a maliEPSS 0.1%CVE-2026-31912MEDIUMOOBR in libpcap before 1.10.7EPSS 0.1%CVE-2025-20796HIGHIn imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a mEPSS 0.1%