CWE-118Incorrect Access of Indexable Resource ('Range Error')

Abstraction: Class · CVEs in our corpus: 25

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Last updated: 14 October 2026 20:41 UTC

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2015-2000`	7.7	9.8	0.0198	2018-03-29
`CVE-2015-2001`	7.7	9.8	0.0198	2018-03-29
`CVE-2015-2002`	7.7	9.8	0.0226	2018-03-29
`CVE-2015-2003`	7.7	9.8	0.0198	2018-03-29
`CVE-2015-2004`	7.7	9.8	0.0198	2018-03-29
`CVE-2015-9142`	7.5	9.8	0.0118	2018-04-18
`CVE-2016-10495`	7.5	9.8	0.0118	2018-04-18
`CVE-2014-9411`	7.4	9.8	0.0084	2017-08-18
`CVE-2017-5884`	6.3	7.8	0.0232	2017-02-28
`CVE-2020-3369`	6.1	7.5	0.0141	2020-07-16
`CVE-2020-3235`	6.0	7.7	0.0157	2020-06-03
`CVE-2018-7530`	5.8	7.8	0.0033	2018-04-17
`CVE-2023-37921`	5.8	7.8	0.0043	2024-01-08
`CVE-2023-37922`	5.8	7.8	0.0043	2024-01-08
`CVE-2023-37923`	5.8	7.8	0.0043	2024-01-08
`CVE-2026-50367`	5.8	7.8	0.0033	2026-07-14
`CVE-2017-10872`	5.5	6.5	0.0194	2017-12-22
`CVE-2022-38072`	5.4	6.5	0.0106	2023-04-03
`CVE-2024-43524`	5.3	6.8	0.0067	2024-10-08
`CVE-2022-36402`	5.0	6.3	0.0060	2022-09-16
`CVE-2023-0201`	5.0	6.7	0.0020	2023-04-22
`CVE-2019-6130`	4.7	5.5	0.0156	2019-01-11
`CVE-2025-48902`	4.5	6.6	0.0010	2025-06-06
`CVE-2017-0302`	4.4	5.3	0.0074	2017-05-09
`CVE-2025-54628`	4.3	5.3	0.0022	2025-08-06