Falhas do tipo CWE-129

323 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo leitura ou escrita fora dos limites da estrutura. Um atacante pode explorar isso para ler dados sensíveis da memória adjacente, sobrescrever dados críticos ou executar código arbitrário.

Exemplo

Um aplicativo web recebe um ID de usuário vindo de um parâmetro GET e o usa diretamente como índice em um array de usuários sem verificar se está dentro do tamanho válido. Um atacante fornece um índice negativo ou muito grande, acessando registros de outros usuários ou corrompendo estruturas internas.

Como mitigar

Sempre validar o índice antes do acesso: verificar se está >= 0 e < tamanho_do_array. Use bibliotecas que oferecem acesso seguro a coleções (como listas tipadas em linguagens modernas) e implemente testes de boundary para casos extremos durante o desenvolvimento.

CVE-2026-57251HIGHFoxit PDF Editor/Reader Cloud Appearance Buffer Overflow VulnerabilityEPSS 0.2%CVE-2023-20601MEDIUMImproper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-EPSS 0.2%CVE-2023-2570HIGH A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execuEPSS 0.2%CVE-2026-50144HIGHncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter idEPSS 0.2%CVE-2024-32673MEDIUMImproper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.EPSS 0.2%CVE-2025-30077MEDIUMOpen Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of EPSS 0.2%CVE-2026-33762LOWgo-git: Missing validation decoding Index v4 files leads to panicEPSS 0.2%CVE-2023-53395HIGHACPICA: Add AML_NO_OPERAND_RESOLVE flag to TimerEPSS 0.2%CVE-2023-31307LOWImproper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory readEPSS 0.2%CVE-2026-63635MEDIUMOpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoSEPSS 0.2%CVE-2026-30982MEDIUMiccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert()EPSS 0.1%CVE-2026-30984MEDIUMiccDEV has a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence()EPSS 0.1%CVE-2025-54650MEDIUMImproper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect EPSS 0.1%CVE-2024-5680HIGHCWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local EPSS 0.1%CVE-2023-33053HIGHImproper Validation of Array Index in KernelEPSS 0.1%CVE-2026-24181HIGHNVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of thisEPSS 0.1%CVE-2026-85084MEDIUMOut-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds checkEPSS 0.1%CVE-2024-21970MEDIUMImproper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentiEPSS 0.1%CVE-2026-63420MEDIUMOpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`EPSS 0.1%CVE-2026-88052HIGHTesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronizationEPSS 0.1%