Fallos del tipo CWE-129

381 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2026-24238HIGHNVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index. A successful exploit of thEPSS 0.2%CVE-2023-52728MEDIUMOpen Networking Foundation SD-RAN ONOS onos-lib-go 0.10.25 allows an index out-of-range condition in putBitString.EPSS 0.2%CVE-2026-89319MEDIUMJweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocationEPSS 0.2%CVE-2026-20527MEDIUMIn Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connectedEPSS 0.2%CVE-2026-63420MEDIUMOpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`EPSS 0.2%CVE-2024-50291HIGHmedia: dvb-core: add missing buffer index checkEPSS 0.2%CVE-2025-23338LOWNVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm where a user may cause an out-of-bounds write by running nvdisasmEPSS 0.2%CVE-2026-93989LOWvLLM through 0.29.0 Cross-Request Logits Corruption via bad_wordsEPSS 0.2%CVE-2025-23278HIGHNVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing aEPSS 0.2%CVE-2024-50161HIGHbpf: Check the remaining info_cnt before repeating btf fieldsEPSS 0.2%CVE-2021-47449HIGHice: fix locking for Tx timestamp tracking flushEPSS 0.2%CVE-2026-25068MEDIUMalsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer OverflowEPSS 0.2%CVE-2026-63635MEDIUMOpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoSEPSS 0.2%CVE-2026-62866MEDIUMDasel: Selector lexer panics on trailing whitespace in `parseCurRune`EPSS 0.2%CVE-2021-1117MEDIUMWindows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific confiEPSS 0.2%CVE-2026-40097LOWStep CA affected by an index out of bounds panic in TPM attestation EKU validationEPSS 0.2%CVE-2026-46377MEDIUMDasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringEPSS 0.2%CVE-2022-33289MEDIUMImproper validation of array index in ModemEPSS 0.2%CVE-2026-107737MEDIUMSumatraPDF CHM `its://` signed index causes an out-of-bounds object lookupEPSS 0.2%CVE-2026-102511HIGHApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themEPSS 0.2%