Weaknesses of type CWE-129

381 results

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente se um índice está dentro dos limites válidos do array antes de acessá-lo. Um atacante pode fornecer um índice fora dos limites (negativo ou maior que o tamanho), causando leitura ou escrita em endereços de memória inválidos, resultando em crash, vazamento de dados ou execução de código arbitrário.

Example

Uma API web recebe um parâmetro 'posição' do usuário e acessa um array sem verificar se a posição é válida. Um atacante envia posição=-1 ou posição=999999, lendo/alterando memória adjacente ao array, ou causando segmentation fault.

How to mitigate

Sempre validar que o índice é >= 0 e < tamanho do array antes de usar. Em linguagens de alto nível, preferir iteradores ou métodos nativos que validam automaticamente; em C/C++, usar bounds checking explícito ou bibliotecas como AddressSanitizer durante testes.

CVE-2026-22879HIGHA heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom (version(s): 9.5.2EPSS 0.5%CVE-2026-63308MEDIUMHelm Files.Lines Denial of Service via Empty Chart FilesEPSS 0.5%CVE-2026-31967MEDIUMHTSlib CRAM reader has out-of-bounds read due to improper validation of inputEPSS 0.5%CVE-2026-119299MEDIUMgopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segmentsEPSS 0.5%CVE-2026-14193HIGHDVP80ES300T - Improper Validation of Array Index VulnerabilityEPSS 0.5%CVE-2026-57268HIGHGeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityEPSS 0.5%CVE-2026-73489MEDIUMRussh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsEPSS 0.5%CVE-2026-123200HIGHVRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length indexEPSS 0.4%CVE-2024-22181HIGHAn out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0. A specially crafted .node file can lead to an ouEPSS 0.4%CVE-2026-70635HIGHTimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative IndexEPSS 0.4%CVE-2026-14191HIGHWinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeaderEPSS 0.4%CVE-2023-39234HIGHMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crEPSS 0.4%CVE-2023-39235HIGHMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crEPSS 0.4%CVE-2026-32937HIGHfree5GC CHF has Out-of-Bounds Slice Access that Leads to DoSEPSS 0.4%CVE-2026-0528MEDIUMImproper Input Validation in Metricbeat Leading to Denial of ServiceEPSS 0.4%CVE-2024-58400HIGHllama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDsEPSS 0.4%CVE-2023-35995HIGHMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaEPSS 0.4%CVE-2026-44222MEDIUMvLLM: Remote DoS via Special-Token PlaceholdersEPSS 0.4%CVE-2025-27034CRITICALImproper Validation of Array Index in Multi-Mode Call ProcessorEPSS 0.4%CVE-2023-35996HIGHMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaEPSS 0.4%