CWE-118, Incorrect Access of Indexable Resource (Range Error), is a class level entry. The product does not restrict, or incorrectly restricts, operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
It is an umbrella. The buffer overflows, out-of-bounds reads and similar bugs that people meet in practice are specific cases beneath it, and MITRE lists it as neither language nor technology specific.
How it happens
Anything addressed by position can be addressed wrongly: arrays, buffers, strings, file offsets. The code computes or accepts an index, and either never compares it with the size of the resource, or compares it incorrectly.
// Illustrative: the index is trusted
int read_item(int *items, int count, int idx) {
return items[idx]; // no check that 0 <= idx < count
}
Languages with bounds checking turn this into an exception. Languages without it turn it into a read or write of whatever sits at that address.
What an attacker gains
MITRE lists the consequence as varying by context. Because this is a parent class, the concrete impact depends on the child weakness and the platform: a crash, disclosure of neighboring data, or corruption that leads to code execution.
How to find it
MITRE's record lists no detection methods for the class itself. Look at the child weaknesses for specifics. A general approach: review every access that uses an externally influenced index, and test boundary values such as zero, one, the size, the size plus one, and negative numbers.
How to fix it
MITRE's record gives no mitigations at this level, so use the basics. Check each index against the actual size of the resource immediately before use. Keep the size and the data together in one structure so they cannot disagree. Prefer memory safe languages and bounds checked containers where you can.
int read_item(int *items, int count, int idx, int *out) {
if (idx < 0 || idx >= count) return -1;
*out = items[idx];
return 0;
}
Quick check
Why is this a class and not a single bug?
It describes the shared idea behind many specific range errors. The details of impact and fix depend on which child weakness applies.
