Fallos del tipo CWE-193

129 resultados

Erro de índice por um (Off-by-One)

Ocorre quando a lógica de um loop ou acesso a array usa um índice incorreto — geralmente começando em 0 quando deveria começar em 1, ou iterando até N quando deveria parar em N-1. O resultado é acesso a posições inválidas de memória, leitura/escrita fora dos limites do buffer, ou skip de um elemento legítimo, criando brechas de segurança e crashes.

Ejemplo

Um loop que processa 10 elementos de um array mas itera de 0 a 10 (incluindo 10) tenta acessar posição 10 que não existe; ou um validador que checa strings até tamanho N mas esquece o caractere final, deixando dados não validados. Ataques exploram isso para corrupção de heap, escape de sandbox ou leitura de memória sensível.

Cómo mitigar

Use iteradores de linguagem de alto nível (for-each, ranges) que abstraem índices; ao usar índices explícitos, teste sempre com boundary values (tamanho-1, tamanho, tamanho+1); aplique assertions e sanitização rigorosa em loops críticos; prefira bibliotecas que fazem bounds-checking automático.

CVE-2026-4887MEDIUMGimp: gimp:memory disclosure and denial of service via specially crafted pcx imageEPSS 0.6%CVE-2023-27477LOWwasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the EPSS 0.6%CVE-2026-12413HIGHIKEv2 Denial of Service via malformed fragmentationEPSS 0.6%CVE-2026-56787MEDIUMRTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR MessageEPSS 0.6%CVE-2025-43973MEDIUMAn issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in whEPSS 0.6%CVE-2006-10003CRITICALXML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stackEPSS 0.5%CVE-2025-43971HIGHAn issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionEPSS 0.5%CVE-2026-54410HIGHnanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length FieldEPSS 0.5%CVE-2026-43964LOWPostfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced statuEPSS 0.5%CVE-2026-49127HIGHMusic Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24beEPSS 0.5%CVE-2026-52804MEDIUMGogs: Privilege Escalation via Collaboration Access Mode ValidationEPSS 0.5%CVE-2026-44042LOWUltraVNC repeater wi_uudecode off-by-one in base64 decode boundary checkEPSS 0.5%CVE-2026-31988MEDIUMyauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp ParserEPSS 0.5%CVE-2024-45796MEDIUMSuricata defrag: off by one can lead to policy bypassEPSS 0.5%CVE-2026-32605HIGHNimiq: Remote crash via off-by-one signer bounds check in proposal bufferEPSS 0.5%CVE-2017-2618MEDIUMA flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write EPSS 0.5%CVE-2025-47711MEDIUMNbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of serviceEPSS 0.5%CVE-2025-30742MEDIUMhttpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not haEPSS 0.4%CVE-2022-3821MEDIUMAn off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values fEPSS 0.4%CVE-2026-81396HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 0.4%