An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wavpackUpgrade wavpack-devel | Nov 14, 2022 | Mar 10, 2022 |
| Alpine Linux | — | Upgrade wavpack | Aug 22, 2024 | Mar 10, 2022 |
| Centos_linux | — | Upgrade wavpack-debuginfoUpgrade wavpackUpgrade wavpack-debugsource | Nov 9, 2022 | Mar 10, 2022 |
| Debian | — | Upgrade wavpack | Jul 30, 2024 | Mar 10, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wavpack | Jun 22, 2022 | Mar 10, 2022 |
| Oracle_linux | — | Upgrade wavpackUpgrade wavpack-devel | Nov 16, 2022 | Nov 23, 2021 |
| Redhat_linux | — | No solution existsUpgrade wavpack-debugsourceUpgrade wavpack-debuginfoUpgrade wavpackUpgrade wavpack-devel | Nov 9, 2022 | Mar 10, 2022 |
| Rocky_linux | — | Upgrade wavpack-develUpgrade wavpackUpgrade wavpack-debuginfoUpgrade wavpack-debugsource | Mar 12, 2024 | Mar 10, 2022 |
| Suse | — | Upgrade libwavpack1Upgrade libwavpack1-32bitUpgrade wavpack-develUpgrade wavpack | Oct 26, 2022 | Mar 10, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 10, 2022 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub