PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2020-35738

CVE-2020-35738

wavpack: out-of-bounds write in WavpackPackSamples function in pack_utils.c

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.1

Review impact separately from score.

Published · December 27, 2020

Updated · June 27, 2026

Description

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

If using the wavpack utility, this flaw can be mitigated by not running the program on untrusted input files or files from untrusted sources.

CVSS / CWE

CVSS 3.1 · 6.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

CWE-190 · Integer Overflow or Wraparound