Fallos del tipo CWE-129

323 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2026-57251HIGHFoxit PDF Editor/Reader Cloud Appearance Buffer Overflow VulnerabilityEPSS 0.2%CVE-2023-20601MEDIUMImproper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-EPSS 0.2%CVE-2023-2570HIGH A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execuEPSS 0.2%CVE-2026-50144HIGHncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter idEPSS 0.2%CVE-2024-32673MEDIUMImproper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.EPSS 0.2%CVE-2025-30077MEDIUMOpen Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of EPSS 0.2%CVE-2026-33762LOWgo-git: Missing validation decoding Index v4 files leads to panicEPSS 0.2%CVE-2023-53395HIGHACPICA: Add AML_NO_OPERAND_RESOLVE flag to TimerEPSS 0.2%CVE-2023-31307LOWImproper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory readEPSS 0.2%CVE-2026-63635MEDIUMOpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoSEPSS 0.2%CVE-2026-30982MEDIUMiccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert()EPSS 0.1%CVE-2026-30984MEDIUMiccDEV has a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence()EPSS 0.1%CVE-2025-54650MEDIUMImproper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect EPSS 0.1%CVE-2024-5680HIGHCWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local EPSS 0.1%CVE-2023-33053HIGHImproper Validation of Array Index in KernelEPSS 0.1%CVE-2026-24181HIGHNVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of thisEPSS 0.1%CVE-2026-85084MEDIUMOut-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds checkEPSS 0.1%CVE-2024-21970MEDIUMImproper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentiEPSS 0.1%CVE-2026-63420MEDIUMOpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`EPSS 0.1%CVE-2026-88052HIGHTesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronizationEPSS 0.1%