Fallos del tipo CWE-129

381 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2023-31307LOWImproper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory readEPSS 0.2%CVE-2026-47507HIGHNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-boundsEPSS 0.1%CVE-2024-5680HIGHCWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local EPSS 0.1%CVE-2026-47525MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper EPSS 0.1%CVE-2023-33053HIGHImproper Validation of Array Index in KernelEPSS 0.1%CVE-2026-47533MEDIUMNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper EPSS 0.1%CVE-2026-24181HIGHNVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of thisEPSS 0.1%CVE-2026-17097HIGHPower System Improper ValidationEPSS 0.1%CVE-2025-66366—Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crashEPSS 0.1%CVE-2023-31308LOWA malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory reaEPSS 0.1%CVE-2026-116731MEDIUMFurnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block ImportEPSS 0.1%CVE-2024-21970MEDIUMImproper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentiEPSS 0.1%CVE-2026-116816HIGHllama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 TokenizerEPSS 0.1%CVE-2026-85084MEDIUMOut-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds checkEPSS 0.1%CVE-2026-44310MEDIUMgitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callersEPSS 0.1%CVE-2026-65165MEDIUMNVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary optEPSS 0.1%CVE-2026-115722MEDIUMRPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY HeaderEPSS 0.1%CVE-2026-103672MEDIUMHMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array IndexEPSS 0.1%CVE-2023-31306LOWImproper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamicEPSS 0.1%CVE-2022-25695HIGHMemory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, SnapdragonEPSS 0.1%