CVE-2018-10539

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier

Description: An issue was discovered related to DSDiff input, where out-of-bounds writes can occur due to a lack of validation of unknown chunk sizes in the ParseDsdiffHeaderConfig function. This is caused by insufficient integer-overflow protection within a bytes to copy calculation and a subsequent malloc call, leading to insufficient memory allocation.

Recommendations: For WavPack versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.