An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wavpackUpgrade wavpack-devel | Nov 14, 2022 | Mar 10, 2022 |
| Alpine Linux | — | Upgrade wavpack | Aug 22, 2024 | Mar 10, 2022 |
| Centos_linux | — | Upgrade wavpack-debuginfoUpgrade wavpack-debugsourceUpgrade wavpack | Nov 9, 2022 | Mar 10, 2022 |
| Debian | — | Upgrade wavpack | Jul 30, 2024 | Mar 10, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wavpack | Jun 22, 2022 | Mar 10, 2022 |
| Oracle_linux | — | Upgrade wavpack-develUpgrade wavpack | Nov 16, 2022 | Nov 23, 2021 |
| Redhat_linux | — | Upgrade wavpack-debuginfoUpgrade wavpack-develUpgrade wavpackNo solution existsUpgrade wavpack-debugsource | Nov 9, 2022 | Mar 10, 2022 |
| Rocky_linux | — | Upgrade wavpackUpgrade wavpack-debuginfoUpgrade wavpack-develUpgrade wavpack-debugsource | Mar 12, 2024 | Mar 10, 2022 |
| Suse | — | Upgrade wavpackUpgrade libwavpack1Upgrade libwavpack1-32bitUpgrade wavpack-devel | Oct 26, 2022 | Mar 10, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 10, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub