Fallos del tipo CWE-129

381 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2024-45582HIGHImproper Validation of Array Index in Camera DriverEPSS 0.1%CVE-2024-49832HIGHImproper Validation of Array Index in CameraEPSS 0.1%CVE-2024-33032MEDIUMImproper Validation of Array Index in Camera_LinuxEPSS 0.1%CVE-2025-27075HIGHImproper Validation of Array Index in Bluetooth HOSTEPSS 0.1%CVE-2025-27067HIGHImproper Validation of Array Index in DSP ServiceEPSS 0.1%CVE-2024-53009MEDIUMImproper Validation of Array Index in Automotive AutonomyEPSS 0.1%CVE-2025-54645MEDIUMOut-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of thEPSS 0.1%CVE-2026-103220MEDIUMThe Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image datEPSS 0.1%CVE-2023-20633MEDIUMIn usb, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System EPSS 0.1%CVE-2022-47345MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47347MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47343MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47342MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47346MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47344MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47348MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2025-47352HIGHImproper Validation of Array Index in AudioEPSS 0.1%CVE-2025-47361HIGHImproper Validation of Array Index in Automotive Software platform based on QNXEPSS 0.1%CVE-2025-47393HIGHImproper Validation of Array Index in Automotive Linux OSEPSS 0.1%CVE-2026-25276HIGHImproper Validation of Array Index in Secure ProcessorEPSS 0.1%