CVE-2021-44269
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered...
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
CVE-2021-44269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
CVE-2021-44269- Updated
- 2026-11-02
EUVDEUVD-2021-31115 No score
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
EUVD-2021-31115- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f35r-5xp5-9859
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered...
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
GHSA-f35r-5xp5-9859- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-44269
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
ALPINE-CVE-2021-44269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVAZL-8977
CVE-2021-44269 affecting package wavpack for versions less than 5.6.0-1
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
AZL-8977- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSV
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
CVE-2021-44269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-44269
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
DEBIAN-CVE-2021-44269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2022:7558
Red Hat Security Advisory: wavpack security update
- Record
RHSA-2022:7558- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2022:8139
Red Hat Security Advisory: wavpack security update
- Record
RHSA-2022:8139- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRLSA-2022:7558
Low: wavpack security update
WavPack is a completely open audio compression format providing lossless, high-quality lossy and a unique hybrid compression mode.
Security Fix(es):
- wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.
- Record
RLSA-2022:7558- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRLSA-2022:8139
Low: wavpack security update
WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode.
Security Fix(es):
- wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.
- Record
RLSA-2022:8139- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-44269
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.
- Record
UBUNTU-CVE-2021-44269- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
OSVALSA-2022:7558 No score
Low: wavpack security update
WavPack is a completely open audio compression format providing lossless, high-quality lossy and a unique hybrid compression mode.
Security Fix(es):
- wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2022:7558- Updated
- 2026-11-02
OSVALSA-2022:8139 No score
Low: wavpack security update
WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode.
Security Fix(es):
- wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2022:8139- Updated
- 2026-11-02
OSVMGASA-2022-0125 No score
Updated wavpack packages fix security vulnerability
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound. (CVE-2021-44269)
- Record
MGASA-2022-0125- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0954-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2021-44269: Fixed out of bounds read in processing .wav files (bsc#1197020).
- Record
openSUSE-SU-2022:0954-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11938-1 No score
libwavpack1-32bit-5.4.0-2.1 on GA media
These are all security issues fixed in the libwavpack1-32bit-5.4.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11938-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0954-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2021-44269: Fixed out of bounds read in processing .wav files (bsc#1197020).
- Record
SUSE-SU-2022:0954-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wavpackAlpine:v3.16 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.17 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.18 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.19 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.20 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.21 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.22 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.23 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlpine:v3.24 |
before 5.5.0-r0 | 5.5.0-r0 |
wavpackAlmaLinux:8 |
before 5.1.0-16.el8 | 5.1.0-16.el8 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wavpack-develAlmaLinux:8 |
before 5.1.0-16.el8 | 5.1.0-16.el8 |
wavpackAlmaLinux:9 |
before 5.4.0-5.el9 | 5.4.0-5.el9 |
wavpack-develAlmaLinux:9 |
before 5.4.0-5.el9 | 5.4.0-5.el9 |
wavpackAzure Linux:2 |
before 5.6.0-1 | 5.6.0-1 |
wavpackDebian:12 |
before 5.5.0-1 | 5.5.0-1 |
wavpackDebian:13 |
before 5.5.0-1 | 5.5.0-1 |
wavpackDebian:14 |
before 5.5.0-1 | 5.5.0-1 |
wavpackMageia:8 |
before 5.3.2-2.1.mga8 | 5.3.2-2.1.mga8 |
wavpackRed Hat:enterprise_linux:8::appstream |
before 0:5.1.0-16.el8 | 0:5.1.0-16.el8 |
wavpack-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:5.1.0-16.el8 | 0:5.1.0-16.el8 |
wavpack-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:5.1.0-16.el8 | 0:5.1.0-16.el8 |
wavpack-debuginfoRed Hat:enterprise_linux:8::crb |
before 0:5.1.0-16.el8 | 0:5.1.0-16.el8 |
wavpack-debugsourceRed Hat:enterprise_linux:8::crb |
before 0:5.1.0-16.el8 | 0:5.1.0-16.el8 |
wavpack-develRed Hat:enterprise_linux:8::crb |
before 0:5.1.0-16.el8 | 0:5.1.0-16.el8 |
wavpackRed Hat:enterprise_linux:9::appstream |
before 0:5.4.0-5.el9 | 0:5.4.0-5.el9 |
wavpack-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:5.4.0-5.el9 | 0:5.4.0-5.el9 |
wavpack-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:5.4.0-5.el9 | 0:5.4.0-5.el9 |
wavpack-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:5.4.0-5.el9 | 0:5.4.0-5.el9 |
wavpack-debugsourceRed Hat:enterprise_linux:9::crb |
before 0:5.4.0-5.el9 | 0:5.4.0-5.el9 |
wavpack-develRed Hat:enterprise_linux:9::crb |
before 0:5.4.0-5.el9 | 0:5.4.0-5.el9 |
wavpackRocky Linux:8 |
before 0:5.1.0-16.el8 | 0:5.1.0-16.el8 |
wavpackRocky Linux:9 |
before 0:5.4.0-5.el9 | 0:5.4.0-5.el9 |
wavpackSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 5.4.0-4.12.1 | 5.4.0-4.12.1 |
wavpackSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 |
before 5.4.0-4.12.1 | 5.4.0-4.12.1 |
wavpackSUSE:Linux Enterprise Real Time 15 SP2 |
before 5.4.0-4.12.1 | 5.4.0-4.12.1 |
wavpackUbuntu:18.04:LTS |
All versions, plus listed versions 5.1.0-25.1.0-2ubuntu15.1.0-2ubuntu1.15.1.0-2ubuntu1.25.1.0-2ubuntu1.35.1.0-2ubuntu1.45.1.0-2ubuntu1.5 |
None known |
wavpackUbuntu:20.04:LTS |
All versions, plus listed versions 5.1.0-75.2.0-15.2.0-1ubuntu0.1 |
None known |
wavpackUbuntu:22.04:LTS |
All versions, plus listed versions 5.4.0-1build15.4.0-1build2 |
None known |
wavpackUbuntu:25.10 |
All versions, plus listed versions 5.8.1-1 |
None known |
wavpackUbuntu:26.10 |
All versions, plus listed versions 5.9.0-15.9.0-2 |
None known |
wavpackUbuntu:26.04:LTS |
All versions, plus listed versions 5.8.1-15.8.1-1build15.9.0-1 |
None known |
wavpackopenSUSE:Leap 15.3 |
before 5.4.0-4.12.1 | 5.4.0-4.12.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-44269 is a medium vulnerability (CVSS 5.5) in Wavpack, published March 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 67th percentile. Fixed in wavpack 5.5.0-r0.
References
github.com/dbry/WavPack/issues/110
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRZWZKEEABCLVXZEXQZBIT3ZKLIXVFF5
Show 31 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-44269
security.alpinelinux.org/vuln/CVE-2021-44269
access.redhat.com/errata/RHSA-2022:7558
bugzilla.redhat.com/2064457
errata.almalinux.org/8/ALSA-2022-7558.html
security-tracker.debian.org/tracker/CVE-2021-44269
advisories.mageia.org/MGASA-2022-0125.html
bugs.mageia.org/show_bug.cgi?id=30215
lists.opensuse.org/archives/list/[email protected]/thread/MA3ZHJ2SJ5F7RD4MVUADLVJ2VXDS4AOS
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7558.json
cve.org/CVERecord?id=CVE-2021-44269
errata.rockylinux.org/RLSA-2022:7558
suse.com/support/update/announcement/2022/suse-su-20220954-1
bugzilla.suse.com/1197020
ubuntu.com/security/CVE-2021-44269