CVE-2018-10537

HIGH 7.8CVE-2018-10537 · Published 29/04/2018 · updated 17/06/2026

In short

CVE-2018-10537 is a HIGH (CVSS 7.8) vulnerability affecting wavpack (wavpack).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
wavpack wavpack	`≤ 5.1.0`	No fix yet

Description

An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.

References

packetstormsecurity.com/files/155743/Slackware-Security-Advisory-wavpack-Updates.html
dbry/WavPack commit 26cb47f · Patch
dbry/WavPack · Issue Tracking
dbry/WavPack · Issue Tracking
dbry/WavPack · Issue Tracking
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH
seclists.org/bugtraq/2019/Dec/37
usn.ubuntu.com/3637-1 · Third Party Advisory
debian.org/security/2018/dsa-4197 · Third Party Advisory

More vulnerabilities in wavpack

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wavpack

≤ 5.1.0

No fix yet

More vulnerabilities in wavpack

See all →