PT-2018-9950

CVE-2018-10536

Published

2018-04-29

Updated

2026-10-31

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier

Description: A issue in the WAV parser component allows writing to memory due to the ParseRiffHeaderConfig function in riff.c not rejecting multiple format chunks.

Recommendations: For versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Alexandru Razvan Caciulescu

Andrew Santosa

Marcel Böhme

Thuan Pham

Vendors

Affected products

Weakness enumeration

CWE-787: Out-of-bounds Write

Related identifiers

CVE-2018-10536