CVE-2020-35738

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

CVSS v2.0 NVD

5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P

EPSS

1.21% chance of exploitation in the next 30 days, 68th percentile

Published

2020-12-28

Updated

2024-08-04

Proof-of-concept exploits (1)

• dbry/WavPack/issues/91461★ · 2026-10-06

Security advisories

• https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html

References

• CVE Record
• NVD entry

Related

• CVE-2018-7253
• CVE-2022-2476