CVE-2018-10540

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier

Description: An issue in WavPack for W64 input can cause out-of-bounds writes due to insufficient validation of unknown chunk sizes in the ParseWave64HeaderConfig function, located in wave64.c. This is related to a lack of integer-overflow protection within a bytes to copy calculation and a subsequent malloc call, leading to insufficient memory allocation.

Recommendations: For WavPack versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.