Fallos del tipo CWE-129

381 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2023-20601MEDIUMImproper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-EPSS 0.2%CVE-2026-30984MEDIUMiccDEV has a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence()EPSS 0.2%CVE-2026-30982MEDIUMiccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert()EPSS 0.2%CVE-2026-100836MEDIUMEdgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainerEPSS 0.2%CVE-2026-33762LOWgo-git: Missing validation decoding Index v4 files leads to panicEPSS 0.2%CVE-2026-49282MEDIUMCapstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashesEPSS 0.2%CVE-2025-54650MEDIUMImproper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect EPSS 0.2%CVE-2026-88052HIGHTesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronizationEPSS 0.2%CVE-2026-82947HIGHMultiple Out-of-Bounds Reads in Frame ProcessingEPSS 0.2%CVE-2026-57251HIGHFoxit PDF Editor/Reader Cloud Appearance Buffer Overflow VulnerabilityEPSS 0.2%CVE-2026-82945MEDIUMMemory Corruption via FMMU Configuration Table OverflowEPSS 0.2%CVE-2026-93862HIGHFireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of ServiceEPSS 0.2%CVE-2026-82327MEDIUMLibsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist dataEPSS 0.2%CVE-2026-50144HIGHncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter idEPSS 0.2%CVE-2025-30077MEDIUMOpen Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of EPSS 0.2%CVE-2023-2570HIGH A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execuEPSS 0.2%CVE-2026-92449MEDIUMBinary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arenaEPSS 0.2%CVE-2024-32673MEDIUMImproper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.EPSS 0.2%CVE-2023-53395HIGHACPICA: Add AML_NO_OPERAND_RESOLVE flag to TimerEPSS 0.2%CVE-2026-93321MEDIUMMalformed LLB file operation can crash buildkitdEPSS 0.2%