342
Nature Type ID Name Page
CanPrecede 823 Use of Out-of-range Pointer Offset 1726
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Resultant : The most common condition situation leading to an out-of-bounds array index is
the use of loop index variables as buffer indexes. If the end condition for the loop is subject
to a flaw, the index can grow or shrink unbounded, therefore causing a buffer overflow or
underflow. Another common situation leading to this condition is the use of a function's
return value, or the resulting value of a calculation directly as an index in to a buffer.
Applicable Platforms
Language : C (Prevalence = Often)
Language : C++ (Prevalence = Often)
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
out-of-bounds array index :
index-out-of-range :
array index underflow :
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity
Availability
DoS: Crash, Exit, or Restart
Use of an index that is outside the bounds of an array will
very likely result in the corruption of relevant memory and
perhaps instructions, leading to a crash, if the values are
outside of the valid memory area.
Integrity Modify Memory
If the memory corrupted is data, rather than instructions,
the system will continue to function with improper values.
Confidentiality
Integrity
Modify Memory
Read Memory
Use of an index that is outside the bounds of an array
can also trigger out-of-bounds read or write operations, or
operations on the wrong objects; i.e., "buffer overflows" are
not always the result. This may result in the exposure or
modification of sensitive data.
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
If the memory accessible by the attacker can be effectively
controlled, it may be possible to execute arbitrary code, as
with a standard buffer overflow and possibly without the
use of large inputs if a precise index can be controlled.
Integrity
Availability
DoS: Crash, Exit, or Restart
Execute Unauthorized Code or Commands
CWE Version 4.14
CWE-129: Improper Validation of Array Index
CWE-129: Improper Validation of Array Index