# Unchecked parser offset or index

Input-derived index, offset or length used to address memory without a bound check at the point of use

_Area: Memory corruption and native code. Seen in 12 disclosed reports; 6 confirmed bounties, median $4,750, range $500-$75,000; latest 2026-10-22. Updated 2026-10-23._

## How it works
A parser reads a number from untrusted input (a file field, a message field, a length, an entity id) and uses it directly as an array index, a pointer offset, or a loop bound. The code assumes the value is already sane because it came from a structure it just parsed. Nothing ties the value to the size of the buffer or table it addresses, so the access lands outside the intended object, or panics when the index exceeds the host buffer. Even a one-byte write or a single out-of-range read is enough when the target is a pointer or a virtual-call slot [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-attacking-titan-m-with-only-one-byte-html.md)[E2](https://bugbountylibrary.com/r/h1%3A584603.md)[E3](https://bugbountylibrary.com/r/p0%3ACVE-2023-28252.md).

## Where it shows up
- Struct field read from a file then used as a stack-buffer offset [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-attacking-titan-m-with-only-one-byte-html.md)
- Network handler indexing a fixed entity table with a client-supplied id [E2](https://bugbountylibrary.com/r/h1%3A584603.md)
- File control fields (iExtendBlock/iFlushBlock) driving array indexing [E3](https://bugbountylibrary.com/r/p0%3ACVE-2023-28252.md)
- Font bitmap X/Y offsets not checked against the allocated size [E4](https://bugbountylibrary.com/r/p0%3ACVE-2023-26369.md)
- One-byte SOT field (TPsot) used as an index into a tile-part array sized from a TLM marker [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-78g4-xqwv-q3g8.md)
- WASM host import indexing a host buffer by a user length [E6](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md)
- Loop guard on `atts[i]` but body accesses `atts[++i]` [E7](https://bugbountylibrary.com/r/h1%3A170618.md)
- Cached "last value" guard skipping re-validation when the index repeats [E8](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-fuzzing-microsoft-rdp-client-using-virtual-channels.md)

## How to review
For every value taken from input, find the access it feeds and the bound it must satisfy. The invariant: the index/offset/length must be checked against the actual size of the object being addressed, in the same units and coordinate space, at the point of use. A stack-buffer offset [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-attacking-titan-m-with-only-one-byte-html.md) and an array index [E2](https://bugbountylibrary.com/r/h1%3A584603.md) are the same class: both must be bounded by the target's real extent. For bitmap offsets, confirm the X/Y advance is validated against the buffer allocated by the metrics function, not against the table's declared size [E4](https://bugbountylibrary.com/r/p0%3ACVE-2023-26369.md). Confirm the check cannot be skipped by state (cached last value, prior PDU) [E8](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-fuzzing-microsoft-rdp-client-using-virtual-channels.md), that host-import bridges bound user lengths [E6](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md), that loop increments cannot step past a sentinel [E7](https://bugbountylibrary.com/r/h1%3A170618.md), and that sibling writers to the same array carry the same guard [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-78g4-xqwv-q3g8.md). A value already clamped by the caller before the access is a false positive; trace back to the source.

## Variants seen
- One-byte OOB write via integer used as stack-buffer offset; canonical minimal case [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-attacking-titan-m-with-only-one-byte-html.md)
- OOB read plus virtual call on fake object from bad entity id [E2](https://bugbountylibrary.com/r/h1%3A584603.md)
- OOB read and one-byte increment driven by file control fields [E3](https://bugbountylibrary.com/r/p0%3ACVE-2023-28252.md)
- Heap OOB write from unchecked bitmap X/Y offsets [E4](https://bugbountylibrary.com/r/p0%3ACVE-2023-26369.md)
- OOB write from a one-byte tile-part index into a TLM-sized array [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-78g4-xqwv-q3g8.md)
- Panic/DoS from unchecked length used as a loop bound in a WASM host import [E6](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md)
- Off-by-one read past a NULL sentinel in an attribute loop [E7](https://bugbountylibrary.com/r/h1%3A170618.md)
- Stateful OOB read bypassing a length check via a cached last-value guard [E8](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-fuzzing-microsoft-rdp-client-using-virtual-channels.md)

## Impact and severity
Ranged from validator crash/chain halt [E6](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md) and heap over-read [E8](https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-fuzzing-microsoft-rdp-client-using-virtual-channels.md) to client RCE [E2](https://bugbountylibrary.com/r/h1%3A584603.md)[E4](https://bugbountylibrary.com/r/p0%3ACVE-2023-26369.md) and SYSTEM privilege escalation [E3](https://bugbountylibrary.com/r/p0%3ACVE-2023-28252.md). Severity rises when the target is a pointer or vtable slot, when memory layout is static (no ASLR) [E1](https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-attacking-titan-m-with-only-one-byte-html.md), and when the bug is remotely reachable through normal parsing [E2](https://bugbountylibrary.com/r/h1%3A584603.md)[E7](https://bugbountylibrary.com/r/h1%3A170618.md). The DoS case [E6](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md) is the same root cause but lower impact: a panic, not a memory write.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-attacking-titan-m-with-only-one-byte-html.md
- E2: https://bugbountylibrary.com/r/h1%3A584603.md
- E3: https://bugbountylibrary.com/r/p0%3ACVE-2023-28252.md
- E4: https://bugbountylibrary.com/r/p0%3ACVE-2023-26369.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-78g4-xqwv-q3g8.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-13.md
- E7: https://bugbountylibrary.com/r/h1%3A170618.md
- E8: https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-fuzzing-microsoft-rdp-client-using-virtual-channels.md