Falhas do tipo CWE-129

323 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo leitura ou escrita fora dos limites da estrutura. Um atacante pode explorar isso para ler dados sensíveis da memória adjacente, sobrescrever dados críticos ou executar código arbitrário.

Exemplo

Um aplicativo web recebe um ID de usuário vindo de um parâmetro GET e o usa diretamente como índice em um array de usuários sem verificar se está dentro do tamanho válido. Um atacante fornece um índice negativo ou muito grande, acessando registros de outros usuários ou corrompendo estruturas internas.

Como mitigar

Sempre validar o índice antes do acesso: verificar se está >= 0 e < tamanho_do_array. Use bibliotecas que oferecem acesso seguro a coleções (como listas tipadas em linguagens modernas) e implemente testes de boundary para casos extremos durante o desenvolvimento.

CVE-2024-45550HIGHImproper Validation of Array Index in DSP ServicesEPSS 0.1%CVE-2024-49832HIGHImproper Validation of Array Index in CameraEPSS 0.1%CVE-2024-45582HIGHImproper Validation of Array Index in Camera DriverEPSS 0.1%CVE-2024-33032MEDIUMImproper Validation of Array Index in Camera_LinuxEPSS 0.1%CVE-2023-31308LOWA malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory reaEPSS 0.1%CVE-2023-20633MEDIUMIn usb, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System EPSS 0.1%CVE-2022-47342MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47345MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47346MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47343MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47348MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47347MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2022-47344MEDIUMIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.EPSS 0.1%CVE-2025-27075HIGHImproper Validation of Array Index in Bluetooth HOSTEPSS 0.1%CVE-2025-27067HIGHImproper Validation of Array Index in DSP ServiceEPSS 0.1%CVE-2024-53009MEDIUMImproper Validation of Array Index in Automotive AutonomyEPSS 0.1%CVE-2025-54645MEDIUMOut-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of thEPSS 0.1%CVE-2025-47361HIGHImproper Validation of Array Index in Automotive Software platform based on QNXEPSS 0.1%CVE-2025-47352HIGHImproper Validation of Array Index in AudioEPSS 0.1%CVE-2025-47393HIGHImproper Validation of Array Index in Automotive Linux OSEPSS 0.1%