Fallos del tipo CWE-129

381 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2025-57052CRITICALcJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote atEPSS 0.7%CVE-2026-45799HIGHWire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding serviceEPSS 0.7%CVE-2024-21493MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a CaddyfileEPSS 0.7%CVE-2026-15685HIGHOllama downloadBlob Improper Validation of Array Index Denial-of-Service VulnerabilityEPSS 0.7%CVE-2026-65653HIGHtemporalio/tchannel-go zero-chunk call fragment causes process terminationEPSS 0.7%CVE-2026-65652HIGHtemporalio/tchannel-go malformed checksum type causes process terminationEPSS 0.7%CVE-2023-26066CRITICALCertain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.EPSS 0.7%CVE-2026-19318CRITICALFireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code ExecutionEPSS 0.7%CVE-2024-0901HIGHSEGV and out of bounds memory read from malicious packetEPSS 0.7%CVE-2026-61695HIGHWire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding serviceEPSS 0.7%CVE-2021-39985HIGHThe HwNearbyMain module has a Improper Validation of Array Index vulnerability.Successful exploitation of this vulnerability may cause a proEPSS 0.7%CVE-2026-92152CRITICALF´: Unvalidated Port Index in GenericHubEPSS 0.7%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.7%CVE-2025-69248MEDIUMfree5GC has Array Index Out of Bounds in AMF Leading to Denial of ServiceEPSS 0.7%CVE-2024-29231MEDIUMImproper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 aEPSS 0.7%CVE-2026-56111HIGHMarlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code HandlerEPSS 0.6%CVE-2023-22408HIGHJunos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crashEPSS 0.6%CVE-2026-84445HIGHgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversEPSS 0.6%CVE-2023-22401HIGHJunos OS and Junos OS Evolved: PTX10008, PTX10016: When a specific SNMP MIB is queried the FPC will crashEPSS 0.6%CVE-2024-47249MEDIUMApache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerEPSS 0.6%