Weaknesses of type CWE-129

381 results

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente se um índice está dentro dos limites válidos do array antes de acessá-lo. Um atacante pode fornecer um índice fora dos limites (negativo ou maior que o tamanho), causando leitura ou escrita em endereços de memória inválidos, resultando em crash, vazamento de dados ou execução de código arbitrário.

Example

Uma API web recebe um parâmetro 'posição' do usuário e acessa um array sem verificar se a posição é válida. Um atacante envia posição=-1 ou posição=999999, lendo/alterando memória adjacente ao array, ou causando segmentation fault.

How to mitigate

Sempre validar que o índice é >= 0 e < tamanho do array antes de usar. Em linguagens de alto nível, preferir iteradores ou métodos nativos que validam automaticamente; em C/C++, usar bounds checking explícito ou bibliotecas como AddressSanitizer durante testes.

CVE-2025-21692HIGHnet: sched: fix ets qdisc OOB IndexingEPSS 0.6%CVE-2026-116783HIGHFreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery dataEPSS 0.6%CVE-2024-21522HIGHAll versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().EPSS 0.6%CVE-2025-15271HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-15270HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.6%CVE-2024-23084HIGHApfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(doubleEPSS 0.6%CVE-2026-57159HIGHPJSIP: SDP parser out-of-bounds write in remote payload-type map maintenanceEPSS 0.6%CVE-2026-56770HIGHlibais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message IDEPSS 0.6%CVE-2026-75614HIGHASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)EPSS 0.6%CVE-2024-34048CRITICALO-RAN RIC I-Release e2mgr lacks array size checks in E2nodeConfigUpdateNotificationHandler.EPSS 0.6%CVE-2024-45569CRITICALImproper Validation of Array Index in WLAN Host CommunicationEPSS 0.6%CVE-2025-65562HIGHThe free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remoteEPSS 0.6%CVE-2020-17401MEDIUMThis vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacEPSS 0.6%CVE-2020-17394MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attackEPSS 0.6%CVE-2026-65832HIGHDeskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexingEPSS 0.6%CVE-2026-31966MEDIUMHTSlib CRAM reader has out-of-bounds read due to improper validation of inputEPSS 0.5%CVE-2024-34050HIGHOpen Networking Foundation SD-RAN Rimedo rimedo-ts 0.1.1 has a slice bounds out-of-range panic in "return uint64(b[2])<<16 | uint64(b[1])<<8EPSS 0.5%CVE-2020-8875HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker muEPSS 0.5%CVE-2026-93592HIGHvLLM before 0.28.0 Denial of Service via negative token IDEPSS 0.5%