CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Last updated
Overview
Often, indexable resources such as memory buffers or files can be accessed using a specific position, index, or offset, such as an index for an array or a position for a file. When untrusted input is not properly validated before it is used as an index, attackers could access (or attempt to access) unauthorized portions of these resources. This could be used to cause buffer overflows, excessive resource allocation, or trigger unexpected failures.
Real-world CVEs
46 recorded CVEs are caused by CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input). The highest-severity and most recent are shown first. 14 new CWE-1285 CVEs have been recorded so far in 2026 (17 in 2025).
- CVE-2025-3357
IBM Tivoli Monitoring code execution
Critical · CVSS 9.8 · EPSS 54th2025-05-28 - CVE-2026-33557
Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
Critical · CVSS 9.1 · EPSS 44th2026-04-20 - CVE-2025-3755
Information Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU module
Critical · CVSS 9.1 · EPSS 50th2025-05-29 - CVE-2026-12681High · CVSS 8.9 · EPSS 9th2026-06-24
- CVE-2024-36342High · CVSS 8.8 · EPSS 5th2025-09-06
- CVE-2025-57777
Out Of Bounds Write in displ2.dll when parsing a DSB file with Digilent DASYLab
High · CVSS 8.5 · EPSS 17th2025-09-02 - CVE-2025-57775
Heap-based Buffer Overflow when parsing a DSB file with Digilent DASYLab
High · CVSS 8.5 · EPSS 16th2025-09-02 - CVE-2025-57778
Out Of Bounds Write to invalid source address when parsing a DSB file with Digilent DASYLab
High · CVSS 8.5 · EPSS 17th2025-09-02 - CVE-2025-57776
Out Of Bounds Write to invalid address when parsing a DSB file with Digilent DASYLab
High · CVSS 8.5 · EPSS 17th2025-09-02 - CVE-2025-57774
Out Of Bounds Write of invalid data when parsing a DSB file with Digilent DASYLab
High · CVSS 8.5 · EPSS 17th2025-09-02 - CVE-2025-9189
Out Of Bounds Write when parsing a DSB file with Digilent DASYLab
High · CVSS 8.5 · EPSS 17th2025-09-02 - CVE-2025-7849
Memory Corruption Issue in NI LabVIEW due to improper error handling
High · CVSS 8.5 · EPSS 14th2025-07-29
Showing 12 of 46 recorded CWE-1285 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-1285 vulnerabilitiesCommon consequences
What can happen when CWE-1285 is exploited.
Varies by Context
Affects: Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-1285, grouped by where in the lifecycle they apply.
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Effectiveness: High
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following example retrieves the sizes of messages for a pop3 mail server. The message sizes are retrieved from a socket that returns in a buffer the message number and the message size, the message number (num) and size (size) are extracted from the buffer and the message size is placed into an array using the message number for the array index.
Vulnerable example
/* capture the sizes of all messages */Safe example
/* capture the sizes of all messages */In this example the message number retrieved from the buffer could be a value that is outside the allowable range of indices for the array and could possibly be a negative number. Without proper validation of the value to be used for the array index an array overflow could occur and could potentially lead to unauthorized access to memory addresses and system crashes. The value of the array index should be validated to ensure that it is within the allowable range of indices for the array as in the following code.
In the following example the method displayProductSummary is called from a Web service servlet to retrieve product summary information for display to the user. The servlet obtains the integer value of the product number from the user and passes it to the displayProductSummary method. The displayProductSummary method passes the integer value of the product number to the getProductSummary method which obtains the product summary from the array object containing the project summaries using the integer value of the product number as the array index.
Vulnerable example
// Method called from servlet to obtain product informationSafe example
// Method called from servlet to obtain product informationSafe example
ArrayList productArray = new ArrayList(MAX_PRODUCTS);The following example asks a user for an offset into an array to select an item.
The programmer allows the user to specify which element in the list to select, however an attacker can provide an out-of-bounds offset, resulting in a buffer over-read (CWE-126).
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2005-0369 — large ID in packet used as array index
- CVE-2001-1009 — negative array index as argument to POP LIST command
Frequently asked questions
Common questions about CWE-1285.
- What is CWE-1285?
- The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
- What CVEs are caused by CWE-1285?
- 46 recorded CVEs are attributed to CWE-1285, including CVE-2025-3357, CVE-2026-33557, CVE-2025-3755.
- How do you prevent CWE-1285?
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- How is CWE-1285 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-1285?
- Exploiting CWE-1285 can lead to: Varies by Context.
- Is CWE-1285 actively exploited?
- 46 recorded CVEs are caused by CWE-1285; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-1285) (opens in a new tab)
- CWE-1285 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-1285
Get alerted the moment a new CWE-1285 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.