CVE-2020-35738

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later “unofficial” releases through 5.3.2, which are also affected.

Mitigation

If using the wavpack utility, this flaw can be mitigated by not running the program on untrusted input files or files from untrusted sources.