Falhas do tipo CWE-129

381 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo leitura ou escrita fora dos limites da estrutura. Um atacante pode explorar isso para ler dados sensíveis da memória adjacente, sobrescrever dados críticos ou executar código arbitrário.

Exemplo

Um aplicativo web recebe um ID de usuário vindo de um parâmetro GET e o usa diretamente como índice em um array de usuários sem verificar se está dentro do tamanho válido. Um atacante fornece um índice negativo ou muito grande, acessando registros de outros usuários ou corrompendo estruturas internas.

Como mitigar

Sempre validar o índice antes do acesso: verificar se está >= 0 e < tamanho_do_array. Use bibliotecas que oferecem acesso seguro a coleções (como listas tipadas em linguagens modernas) e implemente testes de boundary para casos extremos durante o desenvolvimento.

CVE-2025-21692HIGHnet: sched: fix ets qdisc OOB IndexingEPSS 0.6%CVE-2026-116783HIGHFreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery dataEPSS 0.6%CVE-2024-21522HIGHAll versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().EPSS 0.6%CVE-2025-15271HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-15270HIGHFontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-52856HIGHWings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceEPSS 0.6%CVE-2024-23084HIGHApfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(doubleEPSS 0.6%CVE-2026-57159HIGHPJSIP: SDP parser out-of-bounds write in remote payload-type map maintenanceEPSS 0.6%CVE-2026-56770HIGHlibais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message IDEPSS 0.6%CVE-2026-75614HIGHASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)EPSS 0.6%CVE-2024-34048CRITICALO-RAN RIC I-Release e2mgr lacks array size checks in E2nodeConfigUpdateNotificationHandler.EPSS 0.6%CVE-2024-45569CRITICALImproper Validation of Array Index in WLAN Host CommunicationEPSS 0.6%CVE-2025-65562HIGHThe free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remoteEPSS 0.6%CVE-2020-17401MEDIUMThis vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacEPSS 0.6%CVE-2020-17394MEDIUMThis vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attackEPSS 0.6%CVE-2026-65832HIGHDeskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexingEPSS 0.6%CVE-2026-31966MEDIUMHTSlib CRAM reader has out-of-bounds read due to improper validation of inputEPSS 0.5%CVE-2024-34050HIGHOpen Networking Foundation SD-RAN Rimedo rimedo-ts 0.1.1 has a slice bounds out-of-range panic in "return uint64(b[2])<<16 | uint64(b[1])<<8EPSS 0.5%CVE-2020-8875HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker muEPSS 0.5%CVE-2026-93592HIGHvLLM before 0.28.0 Denial of Service via negative token IDEPSS 0.5%