Every CVE Search/ Get API key

CVE-2022-2476

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log:...

5.5 MediumFix available

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.38%Down 0.5 points since Jul 20, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
CVE-2022-2476
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
CVE-2022-2476
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2022-34735 No score

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
EUVD-2022-34735
Updated
2026-11-03
GitHub AdvisoriesGHSA-62q3-hj99-8qw6 5.5

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log:...

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
GHSA-62q3-hj99-8qw6
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVAZL-10317 5.5

CVE-2022-2476 affecting package wavpack for versions less than 5.6.0-1

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
AZL-10317
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2514 5.5

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.

Security Fix(es):

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)

Record
OESA-2024-2514
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVOESA-2024-2515 5.5

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.

Security Fix(es):

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)

Record
OESA-2024-2515
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2516 5.5

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.

Security Fix(es):

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)

Record
OESA-2024-2516
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2517 5.5

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.

Security Fix(es):

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)

Record
OESA-2024-2517
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-2476 5.5

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
UBUNTU-CVE-2022-2476
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-06
OSVCLSA-2026-1784814430 No score

wavpack: Fix of CVE-2022-2476

  • CVE-2022-2476: sanitize alternate extension metadata before constructing output filenames
Record
CLSA-2026-1784814430
Updated
2026-11-02
OSVCLSA-2026-1785754254 No score

wavpack: Fix of CVE-2022-2476

  • CVE-2022-2476: NULL guard in wvunpack and sanitize alt-extension metadata
Record
CLSA-2026-1785754254
Updated
2026-11-02
OSV No score

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
CVE-2022-2476
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2022-2476 No score

A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING

Record
DEBIAN-CVE-2022-2476
Updated
2026-11-03
OSVMGASA-2022-0291 No score

Updated wavpack packages fix security vulnerability

Null pointer dereference in wvunpack (CVE-2022-2476)

Record
MGASA-2022-0291
Updated
2026-11-02
OSVSUSE-SU-2022:2681-1 No score

Security update for wavpack

This update for wavpack fixes the following issues:

  • CVE-2022-2476: Fixed a Null pointer dereference in wvunpack (bsc#1201716).
Record
SUSE-SU-2022:2681-1
Updated
2026-11-02
OSVSUSE-SU-2022:2682-1 No score

Security update for wavpack

This update for wavpack fixes the following issues:

  • CVE-2022-2476: Fixed a Null pointer dereference in wvunpack (bsc#1201716).
Record
SUSE-SU-2022:2682-1
Updated
2026-11-02
OSVUSN-5721-1 No score

wavpack vulnerability

It was discovered that WavPack was not properly performing checks when dealing with memory. If a user were tricked into decompressing a specially crafted WavPack Audio File, an attacker could possibly use this issue to cause the WavPack decompressor to crash, resulting in a denial of service.

Record
USN-5721-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wavpack
Azure Linux:2
 before 5.6.0-1
5.6.0-1
wavpack
TuxCare:AlmaLinux:9.2
 before 5.4.0-5.el9.tuxcare.els1
5.4.0-5.el9.tuxcare.els1
wavpack-devel
TuxCare:AlmaLinux:9.2
 before 5.4.0-5.el9.tuxcare.els1
5.4.0-5.el9.tuxcare.els1
wavpack
TuxCare:AlmaLinux:9.6
 before 5.4.0-5.el9.tuxcare.els1
5.4.0-5.el9.tuxcare.els1
wavpack-devel
TuxCare:AlmaLinux:9.6
 before 5.4.0-5.el9.tuxcare.els1
5.4.0-5.el9.tuxcare.els1
wavpack
Debian:12
 before 5.5.0-1
5.5.0-1
wavpack
Debian:13
 before 5.5.0-1
5.5.0-1
wavpack
Debian:14
 before 5.5.0-1
5.5.0-1
wavpack
Mageia:8
 before 5.5.0-1.mga8
5.5.0-1.mga8
wavpack
openEuler:20.03-LTS-SP4
 before 5.3.0-3.oe2003sp4
5.3.0-3.oe2003sp4
Show 19 moreShow less
Affected packages
PackageAffectedFixed
wavpack
openEuler:22.03-LTS-SP1
 before 5.3.0-3.oe2203sp1
5.3.0-3.oe2203sp1
wavpack
openEuler:22.03-LTS-SP4
 before 5.3.0-3.oe2203sp4
5.3.0-3.oe2203sp4
wavpack
openEuler:22.03-LTS-SP3
 before 5.3.0-3.oe2203sp3
5.3.0-3.oe2203sp3
wavpack
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 5.4.0-150000.4.15.1
5.4.0-150000.4.15.1
wavpack
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 5.4.0-150000.4.15.1
5.4.0-150000.4.15.1
wavpack
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
 before 5.4.0-150000.4.15.1
5.4.0-150000.4.15.1
wavpack
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 5.4.0-150000.4.15.1
5.4.0-150000.4.15.1
wavpack
openSUSE:Leap 15.3
 before 5.4.0-150000.4.15.1
5.4.0-150000.4.15.1
wavpack
openSUSE:Leap 15.4
 before 5.4.0-150000.4.15.1
5.4.0-150000.4.15.1
wavpack
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 4.60.99-5.12.1
4.60.99-5.12.1
wavpack
SUSE:Linux Enterprise Server 12 SP5
 before 4.60.99-5.12.1
4.60.99-5.12.1
wavpack
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 4.60.99-5.12.1
4.60.99-5.12.1
wavpack
Ubuntu:Pro:16.04:LTS
 before 4.75.2-2ubuntu0.2+esm1, plus listed versions
4.75.0-14.75.2-24.75.2-2ubuntu0.14.75.2-2ubuntu0.2
4.75.2-2ubuntu0.2+esm1
wavpack
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.1.0-25.1.0-2ubuntu15.1.0-2ubuntu1.15.1.0-2ubuntu1.25.1.0-2ubuntu1.35.1.0-2ubuntu1.45.1.0-2ubuntu1.5
 None known
wavpack
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.1.0-75.2.0-15.2.0-1ubuntu0.1
 None known
wavpack
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.4.0-1build15.4.0-1build2
 None known
wavpack
Ubuntu:25.10
 All versions, plus listed versions
5.8.1-1
 None known
wavpack
Ubuntu:26.10
 All versions, plus listed versions
5.9.0-15.9.0-2
 None known
wavpack
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.8.1-15.8.1-1build15.9.0-1
 None known

History

History
RecordedChangedSources
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2476 is a medium vulnerability (CVSS 5.5) in Wavpack, published July 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in wavpack 5.6.0-1.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open