PT-2018-9951

CVE-2018-10537

Published

2018-04-29

Updated

2026-10-31

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WavPack versions 5.1.0 and earlier

Description: An issue in the W64 parser component allows writing to memory. This is due to the ParseWave64HeaderConfig function in wave64.c not rejecting multiple format chunks.

Recommendations: For versions 5.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Alexandru Razvan Caciulescu

Andrew Santosa

Marcel Böhme

Thuan Pham

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers

CVE-2018-10537