A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade wavpack | Aug 30, 2018 | Feb 6, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 6, 2018 |
| Debian | — | Upgrade wavpack | Mar 1, 2018 | Feb 6, 2018 |
| Freebsd | — | Upgrade wavpack | May 14, 2018 | May 11, 2018 |
| Suse | — | Upgrade libwavpack1Upgrade wavpack-develUpgrade libwavpack1-32bitUpgrade wavpack | May 20, 2018 | Feb 6, 2018 |
| Ubuntu | — | Upgrade libwavpack1Upgrade wavpack | Feb 13, 2018 | Feb 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub