An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade wavpack-develUpgrade wavpack | Nov 14, 2022 | Mar 10, 2022 |
| Alpine Linux | — | Upgrade wavpack | Aug 22, 2024 | Mar 10, 2022 |
| Centos_linux | — | Upgrade wavpack-debuginfoUpgrade wavpackUpgrade wavpack-debugsource | Nov 9, 2022 | Mar 10, 2022 |
| Debian | — | Upgrade wavpack | Jul 30, 2024 | Mar 10, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade wavpack | Jun 22, 2022 | Mar 10, 2022 |
| Oracle_linux | — | Upgrade wavpack-develUpgrade wavpack | Nov 16, 2022 | Nov 23, 2021 |
| Redhat_linux | — | Upgrade wavpack-debuginfoUpgrade wavpack-develUpgrade wavpackUpgrade wavpack-debugsourceNo solution exists | Nov 9, 2022 | Mar 10, 2022 |
| Rocky_linux | — | Upgrade wavpack-debugsourceUpgrade wavpack-debuginfoUpgrade wavpack-develUpgrade wavpack | Mar 12, 2024 | Mar 10, 2022 |
| Suse | — | Upgrade wavpackUpgrade libwavpack1Upgrade wavpack-develUpgrade libwavpack1-32bit | Oct 26, 2022 | Mar 10, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 10, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub