CVE-2016-10172
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers...
CVE-2016-10172 is a medium vulnerability (CVSS 5.5) in Wavpack Project Wavpack, published March 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in wavpack 5.1.0-r0.
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10172- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10172- Updated
- 2026-11-02
EUVDEUVD-2016-1360 No score
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
EUVD-2016-1360- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xg3f-wmmq-xc35
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers...
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
GHSA-xg3f-wmmq-xc35- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-10172
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
ALPINE-CVE-2016-10172- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10172- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10172
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
DEBIAN-CVE-2016-10172- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2018:0607-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172: Make sure upper and lower boundaries make sense, to avoid out of bounds memory reads that could lead to crashes or disclosing memory. (bsc#1021483)
- Record
SUSE-SU-2018:0607-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0608-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172: Make sure upper and lower boundaries make sense, to avoid out of bounds memory reads that could lead to crashes or disclosing memory. (bsc#1021483)
- Record
SUSE-SU-2018:0608-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wavpackAlpine:v3.10 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.11 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.12 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.13 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.14 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.15 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.16 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.17 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.18 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.19 |
before 5.1.0-r0 | 5.1.0-r0 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wavpackAlpine:v3.2 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.20 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.21 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.22 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.23 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.24 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.3 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.4 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.5 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.6 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.7 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.8 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.9 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackDebian:12 |
before 5.0.0-2 | 5.0.0-2 |
wavpackDebian:13 |
before 5.0.0-2 | 5.0.0-2 |
wavpackDebian:14 |
before 5.0.0-2 | 5.0.0-2 |
wavpackSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Server 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Desktop 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Desktop 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/95883
sourceforge.net/p/wavpack/mailman/message/35561951
openwall.com/lists/oss-security/2017/01/28/9
github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc
nvd.nist.gov/vuln/detail/CVE-2016-10172
Show 9 moreShow less
security.alpinelinux.org/vuln/CVE-2016-10172
security-tracker.debian.org/tracker/CVE-2016-10172
suse.com/support/update/announcement/2018/suse-su-20180607-1
bugzilla.suse.com/1021483