CWE-118: Incorrect Access of Indexable Resource
Filter
The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
What the weakness is: CWE-118 at MITRE. All weaknesses
Related attack patterns (CAPEC): 8
- CAPEC-8 Buffer Overflow in an API Call Likelihood: High · Severity: High
- CAPEC-9 Buffer Overflow in Local Command-Line Utilities Likelihood: High · Severity: High
- CAPEC-10 Buffer Overflow via Environment Variables Likelihood: High · Severity: High
- CAPEC-14 Client-side Injection-induced Buffer Overflow Likelihood: Medium · Severity: High
- CAPEC-24 Filter Failure through Buffer Overflow Likelihood: High · Severity: High
- CAPEC-45 Buffer Overflow via Symbolic Links Likelihood: High · Severity: High
- CAPEC-46 Overflow Variables and Tags Likelihood: High · Severity: High
- CAPEC-47 Buffer Overflow via Parameter Expansion Likelihood: Medium · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-118, as MITRE names them. Credits.
Ask an AI about CWE-118
Show the prompt
Explain CWE-118: Incorrect Access of Indexable Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/118.html and https://cve.bz/cve/cwe/118?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.8CVE-2026-50367EPSS 0.3%
Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
- 7.5CVE-2025-54628EPSS 0.3%
Vulnerability of incomplete verification information in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.
- 6.6CVE-2025-48902EPSS 0.1%
Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may affect availability.
- 6.8CVE-2024-43524EPSS 0.7%
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
- 7.8CVE-2023-37923EPSS 0.4%
Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vu…
- 7.8CVE-2023-37922EPSS 0.4%
Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vu…
- 7.8CVE-2023-37921EPSS 0.4%
Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vu…
- 6.7CVE-2023-0201EPSS 0.2%
NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may lead to code execution, denial of service, compromised integrity, and information…
- 8.8CVE-2022-38072EPSS 1.1%
An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a …
- 5.5CVE-2022-36402EPSS 0.6%
An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on…
- 7.5CVE-2020-3369EPSS 1.4%
A vulnerability in the deep packet inspection (DPI) engine of Cisco SD-WAN vEdge Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improp…
- 7.7CVE-2020-3235EPSS 1.6%
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) co…
- 5.5CVE-2019-6130EPSS 1.6%
Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page-number mishandling in cbz/mucbz.c, cbz/muimg.c, and svg/svg-doc.c.
- 9.8CVE-2016-10495EPSS 1.2%
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, made changes to map the scan type value to an index value that is in range.
- 9.8CVE-2015-9142EPSS 1.2%
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9645, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 8…
- 7.8CVE-2018-7530EPSS 0.3%
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server version…
- 9.8CVE-2015-2004EPSS 2.0%
The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native functi…
- 9.8CVE-2015-2003EPSS 2.0%
The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
- 9.8CVE-2015-2002EPSS 2.3%
The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
- 9.8CVE-2015-2001EPSS 2.0%
The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
- 9.8CVE-2015-2000EPSS 2.0%
The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
- 6.5CVE-2017-10872EPSS 1.9%
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.
- 9.8CVE-2014-9411EPSS 0.9%
In all Qualcomm products with Android releases from CAF using the Linux kernel, the use of an out-of-range pointer offset is potentially possible in rollback protection.
- 5.3CVE-2017-0302EPSS 0.7%
In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters.
- 7.8CVE-2017-5884EPSS 2.3%
gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.