Weaknesses of type CWE-129

321 results

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente se um índice está dentro dos limites válidos do array antes de acessá-lo. Um atacante pode fornecer um índice fora dos limites (negativo ou maior que o tamanho), causando leitura ou escrita em endereços de memória inválidos, resultando em crash, vazamento de dados ou execução de código arbitrário.

Example

Uma API web recebe um parâmetro 'posição' do usuário e acessa um array sem verificar se a posição é válida. Um atacante envia posição=-1 ou posição=999999, lendo/alterando memória adjacente ao array, ou causando segmentation fault.

How to mitigate

Sempre validar que o índice é >= 0 e < tamanho do array antes de usar. Em linguagens de alto nível, preferir iteradores ou métodos nativos que validam automaticamente; em C/C++, usar bounds checking explícito ou bibliotecas como AddressSanitizer durante testes.

CVE-2024-21493MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a CaddyfileEPSS 0.7%CVE-2026-15685HIGHOllama downloadBlob Improper Validation of Array Index Denial-of-Service VulnerabilityEPSS 0.7%CVE-2023-26066CRITICALCertain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.EPSS 0.7%CVE-2024-0901HIGHSEGV and out of bounds memory read from malicious packetEPSS 0.7%CVE-2026-84445HIGHgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversEPSS 0.7%CVE-2026-65653HIGHtemporalio/tchannel-go zero-chunk call fragment causes process terminationEPSS 0.7%CVE-2021-39985HIGHThe HwNearbyMain module has a Improper Validation of Array Index vulnerability.Successful exploitation of this vulnerability may cause a proEPSS 0.7%CVE-2024-29231MEDIUMImproper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 aEPSS 0.7%CVE-2026-56111HIGHMarlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code HandlerEPSS 0.6%CVE-2023-22408HIGHJunos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crashEPSS 0.6%CVE-2025-21692HIGHnet: sched: fix ets qdisc OOB IndexingEPSS 0.6%CVE-2024-47249MEDIUMApache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerEPSS 0.6%CVE-2025-15271HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-15270HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-21522HIGHAll versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().EPSS 0.6%CVE-2023-22401HIGHJunos OS and Junos OS Evolved: PTX10008, PTX10016: When a specific SNMP MIB is queried the FPC will crashEPSS 0.6%CVE-2024-23084HIGHApfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(doubleEPSS 0.6%CVE-2025-69248MEDIUMfree5GC has Array Index Out of Bounds in AMF Leading to Denial of ServiceEPSS 0.6%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.6%CVE-2026-56770HIGHlibais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message IDEPSS 0.6%