WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade wavpack | Aug 22, 2024 | Dec 28, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 28, 2020 |
| Debian | — | Upgrade wavpack | Jan 18, 2021 | Dec 28, 2020 |
| Freebsd | — | Upgrade wavpack | Jan 15, 2021 | Jan 14, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wavpack | Feb 2, 2021 | Dec 28, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 28, 2020 |
| Suse | — | Upgrade wavpackUpgrade wavpack-develUpgrade libwavpack1-32bitUpgrade libwavpack1 | Jan 22, 2021 | Dec 28, 2020 |
| Ubuntu | — | Upgrade wavpack | Jan 7, 2021 | Dec 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub