CWEweakness

CWE-118 Incorrect Access of Indexable Resource

Official page ↗
Alternate terms
Range Error
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Common consequences

• Other: Varies by Context

Related

Attack pattern · CAPEC (8)

  • CAPEC-10 Buffer Overflow via Environment Variables attack pattern
  • CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
  • CAPEC-24 Filter Failure through Buffer Overflow attack pattern
  • CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
  • CAPEC-46 Overflow Variables and Tags attack pattern
  • CAPEC-47 Buffer Overflow via Parameter Expansion attack pattern
  • CAPEC-8 Buffer Overflow in an API Call attack pattern
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities attack pattern

Child of · CWE (1)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness

Referenced by CAPEC · weakness (8)

  • CAPEC-10 Buffer Overflow via Environment Variables attack pattern
  • CAPEC-14 Client-side Injection-induced Buffer Overflow attack pattern
  • CAPEC-24 Filter Failure through Buffer Overflow attack pattern
  • CAPEC-45 Buffer Overflow via Symbolic Links attack pattern
  • CAPEC-46 Overflow Variables and Tags attack pattern
  • CAPEC-47 Buffer Overflow via Parameter Expansion attack pattern
  • CAPEC-8 Buffer Overflow in an API Call attack pattern
  • CAPEC-9 Buffer Overflow in Local Command-Line Utilities attack pattern

Referenced by CVE · weakness (26)

  • CVE-2026-113239 Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code… vulnerability
  • CVE-2026-50367 Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges… vulnerability
  • CVE-2025-54628 Vulnerability of incomplete verification information in the communication module. vulnerability
  • CVE-2025-48902 Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may… vulnerability
  • CVE-2024-43524 Windows Mobile Broadband Driver Remote Code Execution Vulnerability vulnerability
  • CVE-2023-37921 Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. vulnerability
  • CVE-2023-37922 Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. vulnerability
  • CVE-2023-37923 Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. vulnerability
  • CVE-2023-0201 NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable… vulnerability
  • CVE-2022-38072 An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and… vulnerability
  • CVE-2022-36402 An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with… vulnerability
  • CVE-2020-3369 A vulnerability in the deep packet inspection (DPI) engine of Cisco SD-WAN vEdge Routers could allow an unauthenticated, remote attacker to… vulnerability
  • CVE-2020-3235 A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500… vulnerability
  • CVE-2019-6130 Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. vulnerability
  • CVE-2015-9142 In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9645, MDM9650, SD 210/SD 212/SD 205, SD 400,… vulnerability
  • CVE-2016-10495 In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, made changes to map the scan type… vulnerability
  • CVE-2018-7530 Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and… vulnerability
  • CVE-2015-2000 The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable… vulnerability
  • CVE-2015-2001 The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable… vulnerability
  • CVE-2015-2002 The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in… vulnerability
  • CVE-2015-2003 The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method… vulnerability
  • CVE-2015-2004 The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize… vulnerability
  • CVE-2017-10872 H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors. vulnerability
  • CVE-2014-9411 In all Qualcomm products with Android releases from CAF using the Linux kernel, the use of an out-of-range pointer offset is potentially… vulnerability
  • CVE-2017-0302 In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be… vulnerability
  • CVE-2017-5884 gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary… vulnerability

Referenced by CWE · child of (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness