CVE-2016-10172

MEDIUM 5.5CVE-2016-10172 · Published 14/03/2017 · updated 17/06/2026

In short

CVE-2016-10172 is a MEDIUM (CVSS 5.5) vulnerability affecting wavpack (wavpack project).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 82.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
wavpack wavpack_project	`≤ 5.0.0`	No fix yet

Description

The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.

References

openwall.com/lists/oss-security/2017/01/28/9 · Mailing List
securityfocus.com/bid/95883 · Third Party Advisory
dbry/WavPack commit 4bc05fc · Patch
sourceforge.net/p/wavpack/mailman/message/35561951 · Exploit

More vulnerabilities in wavpack

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free