Weaknesses of type CWE-129

324 results

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente se um índice está dentro dos limites válidos do array antes de acessá-lo. Um atacante pode fornecer um índice fora dos limites (negativo ou maior que o tamanho), causando leitura ou escrita em endereços de memória inválidos, resultando em crash, vazamento de dados ou execução de código arbitrário.

Example

Uma API web recebe um parâmetro 'posição' do usuário e acessa um array sem verificar se a posição é válida. Um atacante envia posição=-1 ou posição=999999, lendo/alterando memória adjacente ao array, ou causando segmentation fault.

How to mitigate

Sempre validar que o índice é >= 0 e < tamanho do array antes de usar. Em linguagens de alto nível, preferir iteradores ou métodos nativos que validam automaticamente; em C/C++, usar bounds checking explícito ou bibliotecas como AddressSanitizer durante testes.

CVE-2024-33044HIGHImproper Validation of Array Index in HypervisorEPSS 0.1%CVE-2024-49833HIGHImproper Validation of Array Index in CameraEPSS 0.1%CVE-2024-49832HIGHImproper Validation of Array Index in CameraEPSS 0.1%CVE-2024-45582HIGHImproper Validation of Array Index in Camera DriverEPSS 0.1%CVE-2024-45550HIGHImproper Validation of Array Index in DSP ServicesEPSS 0.1%CVE-2024-33032MEDIUMImproper Validation of Array Index in Camera_LinuxEPSS 0.1%CVE-2023-31308LOWA malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory reaEPSS 0.1%CVE-2023-20633MEDIUMIn usb, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System EPSS 0.1%CVE-2022-47347MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47344MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47348MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47346MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47343MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47345MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47342MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2025-27067HIGHImproper Validation of Array Index in DSP ServiceEPSS 0.1%CVE-2025-27075HIGHImproper Validation of Array Index in Bluetooth HOSTEPSS 0.1%CVE-2024-53009MEDIUMImproper Validation of Array Index in Automotive AutonomyEPSS 0.1%CVE-2025-54645MEDIUMOut-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of thEPSS 0.1%CVE-2025-47361HIGHImproper Validation of Array Index in Automotive Software platform based on QNXEPSS 0.1%