Falhas do tipo CWE-129

321 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo leitura ou escrita fora dos limites da estrutura. Um atacante pode explorar isso para ler dados sensíveis da memória adjacente, sobrescrever dados críticos ou executar código arbitrário.

Exemplo

Um aplicativo web recebe um ID de usuário vindo de um parâmetro GET e o usa diretamente como índice em um array de usuários sem verificar se está dentro do tamanho válido. Um atacante fornece um índice negativo ou muito grande, acessando registros de outros usuários ou corrompendo estruturas internas.

Como mitigar

Sempre validar o índice antes do acesso: verificar se está >= 0 e < tamanho_do_array. Use bibliotecas que oferecem acesso seguro a coleções (como listas tipadas em linguagens modernas) e implemente testes de boundary para casos extremos durante o desenvolvimento.

CVE-2024-21493MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a CaddyfileEPSS 0.7%CVE-2026-15685HIGHOllama downloadBlob Improper Validation of Array Index Denial-of-Service VulnerabilityEPSS 0.7%CVE-2023-26066CRITICALCertain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.EPSS 0.7%CVE-2024-0901HIGHSEGV and out of bounds memory read from malicious packetEPSS 0.7%CVE-2026-84445HIGHgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversEPSS 0.7%CVE-2026-65653HIGHtemporalio/tchannel-go zero-chunk call fragment causes process terminationEPSS 0.7%CVE-2021-39985HIGHThe HwNearbyMain module has a Improper Validation of Array Index vulnerability.Successful exploitation of this vulnerability may cause a proEPSS 0.7%CVE-2024-29231MEDIUMImproper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 aEPSS 0.7%CVE-2026-56111HIGHMarlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code HandlerEPSS 0.6%CVE-2023-22408HIGHJunos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crashEPSS 0.6%CVE-2025-21692HIGHnet: sched: fix ets qdisc OOB IndexingEPSS 0.6%CVE-2024-47249MEDIUMApache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerEPSS 0.6%CVE-2025-15271HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-15270HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2024-21522HIGHAll versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().EPSS 0.6%CVE-2023-22401HIGHJunos OS and Junos OS Evolved: PTX10008, PTX10016: When a specific SNMP MIB is queried the FPC will crashEPSS 0.6%CVE-2024-23084HIGHApfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(doubleEPSS 0.6%CVE-2025-69248MEDIUMfree5GC has Array Index Out of Bounds in AMF Leading to Denial of ServiceEPSS 0.6%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.6%CVE-2026-56770HIGHlibais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message IDEPSS 0.6%