An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wavpack-develUpgrade wavpack | Nov 14, 2022 | Mar 10, 2022 |
| Alpine Linux | — | Upgrade wavpack | Aug 22, 2024 | Mar 10, 2022 |
| Centos_linux | — | Upgrade wavpack-debugsourceUpgrade wavpackUpgrade wavpack-debuginfo | Nov 9, 2022 | Mar 10, 2022 |
| Debian | — | Upgrade wavpack | Jul 30, 2024 | Mar 10, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wavpack | Jun 22, 2022 | Mar 10, 2022 |
| Oracle_linux | — | Upgrade wavpackUpgrade wavpack-devel | Nov 16, 2022 | Nov 23, 2021 |
| Redhat_linux | — | No solution existsUpgrade wavpack-debugsourceUpgrade wavpack-develUpgrade wavpackUpgrade wavpack-debuginfo | Nov 9, 2022 | Mar 10, 2022 |
| Rocky_linux | — | Upgrade wavpack-develUpgrade wavpack-debuginfoUpgrade wavpackUpgrade wavpack-debugsource | Mar 12, 2024 | Mar 10, 2022 |
| Suse | — | Upgrade libwavpack1-32bitUpgrade wavpack-develUpgrade libwavpack1Upgrade wavpack | Oct 26, 2022 | Mar 10, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 10, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub