# Unchecked index into static table

Input-derived index or count reaching a fixed array, bitmap, or lookup table without a range check

_Area: Memory corruption and native code. Seen in 7 disclosed reports; 2 confirmed bounties: $1,000 and $10,000; latest 2026-10-07. Updated 2026-10-23._

## How it works
Code assumes an index or count derived from input is already within the bounds of a fixed array, bitmap, or lookup table. The check either never existed, lives only in a constructor or caller that the real path bypasses, or is defeated by a value the type system does not constrain (negative, huge, non-finite, or a failed parse leaving garbage). The index is then used directly for a read, write, or bit operation, landing outside the table.

## Where it shows up
- Bit operations (`set_bit`/`clear_bit`) with a user-controlled bit index, e.g. `numsyncs` in a driver ioctl [E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-33106.md).
- Scaled offsets into a bitmap: `start_addr * 4` clearing dirty-page bits past the bitmap end [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2024-5-9-cve-2024-21115-an-oracle-virtualbox-lpe-used-to-win-pwn2own.md).
- Fixed tracking arrays with a per-message counter never checked against the array size, e.g. `buffer_entries[16]` [E4](https://bugbountylibrary.com/r/p0%3ACVE-2022-32917.md).
- Struct fields (`tm_mon`, `tm_wday`) used as indices into name arrays after an update function's failure return is ignored [E3](https://bugbountylibrary.com/r/h1%3A188326.md).
- A `tm_mon` used as a loop bound against a fixed 12-element day table [E6](https://bugbountylibrary.com/r/h1%3A192896.md).
- Pixel values converted to integer indices (histograms, LUTs) where the format can hold non-finite floats [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md).

## How to review
For every array, bitmap, or table access, trace the index back to its source. The invariant: before use, the index must be proven within `[0, size)` on the same path that performs the access, not in a constructor or a different caller. Check that parse/update return values are honored before fields are consumed [E3](https://bugbountylibrary.com/r/h1%3A188326.md), that float-to-index conversions reject non-finite and out-of-range values [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md), and that bit indices are bounded against bitmap size [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2024-5-9-cve-2024-21115-an-oracle-virtualbox-lpe-used-to-win-pwn2own.md)[E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-33106.md). Confirm the check covers the actual arithmetic (multiplication, loop bound), not just the raw input [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2024-5-9-cve-2024-21115-an-oracle-virtualbox-lpe-used-to-win-pwn2own.md)[E6](https://bugbountylibrary.com/r/h1%3A192896.md). For counters indexing a static array, verify the counter is compared to the array size before each write [E4](https://bugbountylibrary.com/r/p0%3ACVE-2022-32917.md).

## Variants seen
- Out-of-bounds bit clear via scaled address into a heap bitmap [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2024-5-9-cve-2024-21115-an-oracle-virtualbox-lpe-used-to-win-pwn2own.md).
- Out-of-bounds bit set via unchecked count in an ioctl [E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-33106.md).
- Garbage struct field used as index after ignored failure return [E3](https://bugbountylibrary.com/r/h1%3A188326.md).
- Counter indexing a static array in a driver message handler [E4](https://bugbountylibrary.com/r/p0%3ACVE-2022-32917.md).
- Non-finite luminance used as histogram offset [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md).
- Attacker month used as loop bound over a 12-element table [E6](https://bugbountylibrary.com/r/h1%3A192896.md).

## Impact and severity
Ranged from process crash and memory disclosure [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md)[E6](https://bugbountylibrary.com/r/h1%3A192896.md) to kernel out-of-bounds write enabling LPE and sandbox escape [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2024-5-9-cve-2024-21115-an-oracle-virtualbox-lpe-used-to-win-pwn2own.md)[E2](https://bugbountylibrary.com/r/p0%3ACVE-2023-33106.md)[E4](https://bugbountylibrary.com/r/p0%3ACVE-2022-32917.md). Severity rises when the write is controllable and lands on adjacent kernel or device structures, and when corrupted handles or locks can be steered into a race for arbitrary read/write [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2024-5-9-cve-2024-21115-an-oracle-virtualbox-lpe-used-to-win-pwn2own.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2024-5-9-cve-2024-21115-an-oracle-virtualbox-lpe-used-to-win-pwn2own.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2023-33106.md
- E3: https://bugbountylibrary.com/r/h1%3A188326.md
- E4: https://bugbountylibrary.com/r/p0%3ACVE-2022-32917.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-j3p4-wp97-rph4.md
- E6: https://bugbountylibrary.com/r/h1%3A192896.md