PT-2026-141062

FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack encode init in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a WAV header declaring a huge sample rate...

CLEANSTART-2024-CY48960 read_new_config_info function in open_utils

Security vulnerability affects the wavpack package. The readnewconfiginfo function in openutils...

CLEANSTART-2024-XZ05939 read_code function in read_words

Security vulnerability affects the wavpack package. The readcode function in readwords...

CLEANSTART-2024-YI40695 stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff

Security vulnerability affects the wavpack package. A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff...

CLEANSTART-2024-YN94944 issue was discovered in WavPack 5

Security vulnerability affects the wavpack package. An issue was discovered in WavPack 5...

CLEANSTART-2024-XL38022 issue was discovered in WavPack 5

Security vulnerability affects the wavpack package. An issue was discovered in WavPack 5...

CLEANSTART-2024-SD51257 function WavpackPackInit in pack_utils

Security vulnerability affects the wavpack package. The function WavpackPackInit in packutils...

CLEANSTART-2024-WG80140 WavPack 5

Security vulnerability affects the wavpack package. WavPack 5...

CLEANSTART-2024-BX26934 WavPack 5

Security vulnerability affects the wavpack package. WavPack 5...

PT-2026-142455

Security vulnerability affects the wavpack package. The read code function in read words...

PT-2026-142127

Security vulnerability affects the wavpack package. The function WavpackVerifySingleBlock in open utils...

Astra Linux – vulnerability in gst-plugins-good1.0

A flaw was found in GStreamer’s WavPack audio decoder within gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation 4 blocksamples channels in gstwavpackdechandleframe leads to a very small heap allocation. The WavPack library then...

Astra Linux – vulnerability in wavpack

WavPack 5.3.0 contains an out-of-bounds write in WavpackPackSamples within packutils.c due to an integer overflow in a malloc argument. NOTE: Some third parties claim that there are later “unofficial” releases up to 5.3.2, which are also affected...

Rocky Linux 9 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc (crlsa-2026_37129)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202637129 advisory. gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow CVE-2026-53705 Tenable has extracted the preceding description blo...

Rocky Linux 8 [CIQ] Security Update: wavpack / wavpack-debuginfo / wavpack-debugsource / wavpack-devel (crlsa-2022_7558)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227558 advisory. wavpack: Heap out-of-bounds read in WavpackPackSamples CVE-2021-44269 Tenable has extracted the preceding description block directly from the CIQ security advisory...

AlmaLinux 9.6 [TuxCare] Security Update: wavpack / wavpack-devel (ALMALINUX9.6:CLSA-2026:1785754254)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785754254 advisory. - A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL...

AlmaLinux 9.2 [TuxCare] Security Update: wavpack / wavpack-devel (ALMALINUX9.2:CLSA-2026:1784814430)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784814430 advisory. - A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL...

Rocky Linux 10.2 [CIQ] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-debuginfo / etc (crlsa-2026_36675)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202636675 advisory. gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow CVE-2026-53705 Tenable has extracted the preceding description...

Rocky Linux 8.6 [CIQ] Security Update: wavpack / wavpack-debuginfo / wavpack-debugsource / wavpack-devel Multiple Vulnerabilities (ciqsa-2026_0276)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260276 advisory. This advisory aggregates security fixes for the wavpack SRPM in CIQ LTS 8.6. It addresses 14 CVEs: CVE-2018-10536, CVE-2018-10538, CVE-2018-19840,...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc (ALMALINUX9.6:CLSA-2026:1783971636)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783971636 advisory. - A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer...