Fallos del tipo CWE-129

321 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo que valores fora dos limites sejam usados. Isso pode causar leitura ou escrita de memória inválida, levando a crash, vazamento de dados ou execução de código arbitrário.

Ejemplo

Uma aplicação recebe um ID de usuário via parâmetro HTTP e o usa diretamente como índice em um array de sessões sem verificar se está dentro dos limites. Um atacante envia um índice negativo ou maior que o tamanho do array, acessando memória adjacente e roubando dados de outras sessões.

Cómo mitigar

Sempre validar que o índice está entre 0 e (tamanho_do_array - 1) antes de qualquer acesso. Use funções de linguagem que impõem limites automaticamente (como iteradores) ou implemente verificações explícitas com exceções/retorno de erro.

CVE-2026-73564HIGHfrp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer OverflowEPSS 0.5%CVE-2022-46152HIGHOP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs functionEPSS 0.5%CVE-2023-35126HIGHAn out-of-bounds write vulnerability exists within the parsers for both the "DocumentViewStyles" and "DocumentEditStyles" streams of IchitarEPSS 0.5%CVE-2024-35164MEDIUMApache Guacamole: Improper input validation of console codesEPSS 0.5%CVE-2026-19318CRITICALFireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code ExecutionEPSS 0.5%CVE-2025-61915MEDIUMOpenPrinting CUPS vulnerable to stack based out-of-bound writeEPSS 0.5%CVE-2026-14193HIGHDVP80ES300T - Improper Validation of Array Index VulnerabilityEPSS 0.5%CVE-2026-26932MEDIUMImproper Validation of Array Index in Packetbeat Leading to Denial of ServiceEPSS 0.5%CVE-2026-57268HIGHGeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerabilityEPSS 0.5%CVE-2022-25720CRITICALMemory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectEPSS 0.4%CVE-2026-31967MEDIUMHTSlib CRAM reader has out-of-bounds read due to improper validation of inputEPSS 0.4%CVE-2024-22181HIGHAn out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0. A specially crafted .node file can lead to an ouEPSS 0.4%CVE-2026-14191HIGHWinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeaderEPSS 0.4%CVE-2023-39234HIGHMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crEPSS 0.4%CVE-2023-39235HIGHMultiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crEPSS 0.4%CVE-2026-55209CRITICALresdata insufficiently validates untrusted GRDECL filesEPSS 0.4%CVE-2023-35994HIGHMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaEPSS 0.4%CVE-2026-0528MEDIUMImproper Input Validation in Metricbeat Leading to Denial of ServiceEPSS 0.4%CVE-2026-44222MEDIUMvLLM: Remote DoS via Special-Token PlaceholdersEPSS 0.4%CVE-2023-35996HIGHMultiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaEPSS 0.4%