CWE-118Incorrect Access of Indexable Resource ('Range Error')

Abstraction: Class · CVEs in our corpus: 24

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 14 mapping(s) from 2 framework(s): CAPEC 8 (partial) · ATT&CK 6 (partial)

See the full cumulative-coverage rollup →

NIST 800-53 r5 controls that address this weakness (0)AI

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1068 Exploitation for Privilege Escalation←P →M T1190 Exploit Public-Facing Application←P →M T1203 Exploitation for Client Execution←P →M T1210 Exploitation of Remote Services←P →M T1212 Exploitation for Credential Access←P →P T1687 Exploitation for Defense Impairment←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2014-9411`	7.0	9.8	0.0084	2017-08-18
`CVE-2015-2000`	7.0	9.8	0.0205	2018-03-29
`CVE-2015-2001`	7.0	9.8	0.0205	2018-03-29
`CVE-2015-2002`	7.0	9.8	0.0234	2018-03-29
`CVE-2015-2003`	7.0	9.8	0.0205	2018-03-29
`CVE-2015-2004`	7.0	9.8	0.0205	2018-03-29
`CVE-2015-9142`	7.0	9.8	0.0125	2018-04-18
`CVE-2016-10495`	7.0	9.8	0.0125	2018-04-18
`CVE-2017-5884`	5.5	7.8	0.0224	2017-02-28
`CVE-2018-7530`	5.5	7.8	0.0033	2018-04-17
`CVE-2020-3235`	5.5	7.7	0.0157	2020-06-03
`CVE-2020-3369`	5.5	7.5	0.0141	2020-07-16
`CVE-2023-37921`	5.5	7.8	0.0043	2024-01-08
`CVE-2023-37922`	5.5	7.8	0.0043	2024-01-08
`CVE-2023-37923`	5.5	7.8	0.0043	2024-01-08
`CVE-2017-0302`	3.5	5.3	0.0074	2017-05-09
`CVE-2017-10872`	3.5	6.5	0.0194	2017-12-22
`CVE-2019-6130`	3.5	5.5	0.0156	2019-01-11
`CVE-2022-36402`	3.5	6.3	0.0046	2022-09-16
`CVE-2022-38072`	3.5	6.5	0.0106	2023-04-03
`CVE-2023-0201`	3.5	6.7	0.0020	2023-04-22
`CVE-2024-43524`	3.5	6.8	0.0066	2024-10-08
`CVE-2025-48902` UPD	3.5	6.6	0.0008	2025-06-06
`CVE-2025-54628` UPD	3.5	5.3	0.0022	2025-08-06