CVE-2016-10171
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers...
CVE-2016-10171 is a medium vulnerability (CVSS 5.5) in Wavpack Project Wavpack, published March 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in wavpack 5.1.0-r0.
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10171- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10171- Updated
- 2026-11-02
EUVDEUVD-2016-1359 No score
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
EUVD-2016-1359- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vmqh-827p-p7vc
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers...
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
GHSA-vmqh-827p-p7vc- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-10171
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
ALPINE-CVE-2016-10171- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10171- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10171
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
DEBIAN-CVE-2016-10171- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2018:0607-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172: Make sure upper and lower boundaries make sense, to avoid out of bounds memory reads that could lead to crashes or disclosing memory. (bsc#1021483)
- Record
SUSE-SU-2018:0607-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0608-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172: Make sure upper and lower boundaries make sense, to avoid out of bounds memory reads that could lead to crashes or disclosing memory. (bsc#1021483)
- Record
SUSE-SU-2018:0608-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wavpackAlpine:v3.10 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.11 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.12 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.13 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.14 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.15 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.16 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.17 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.18 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.19 |
before 5.1.0-r0 | 5.1.0-r0 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wavpackAlpine:v3.2 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.20 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.21 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.22 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.23 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.24 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.3 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.4 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.5 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.6 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.7 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.8 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.9 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackDebian:12 |
before 5.0.0-2 | 5.0.0-2 |
wavpackDebian:13 |
before 5.0.0-2 | 5.0.0-2 |
wavpackDebian:14 |
before 5.0.0-2 | 5.0.0-2 |
wavpackSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Server 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Desktop 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Desktop 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
sourceforge.net/p/wavpack/mailman/message/35561939
securityfocus.com/bid/95883
openwall.com/lists/oss-security/2017/01/28/9
github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc
nvd.nist.gov/vuln/detail/CVE-2016-10171
Show 9 moreShow less
security.alpinelinux.org/vuln/CVE-2016-10171
security-tracker.debian.org/tracker/CVE-2016-10171
suse.com/support/update/announcement/2018/suse-su-20180607-1
bugzilla.suse.com/1021483