Every CVE Search/ Get API key

CVE-2020-35738

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an...

6.1 MediumFix available

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

1.21%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
CVE-2020-35738
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-190, CWE-787
Updated
2026-11-02
CVE List No score

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
CVE-2020-35738
Updated
2026-11-02
EUVDEUVD-2020-23394 No score

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
EUVD-2020-23394
Updated
2026-11-03
GitHub AdvisoriesGHSA-pwmw-jmr6-f7c4 No score

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an...

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
GHSA-pwmw-jmr6-f7c4
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2020-35738 6.1

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
ALPINE-CVE-2020-35738
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-03
OSV 6.1

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
CVE-2020-35738
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2020-35738 6.1

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
DEBIAN-CVE-2020-35738
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVOESA-2021-1131 6.1

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.

Security Fix(es):

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.(CVE-2020-35738)

Record
OESA-2021-1131
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-35738 6.1

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Record
UBUNTU-CVE-2020-35738
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVMGASA-2021-0271 No score

Updated wavpack packages fix a security vulnerability

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument (CVE-2020-35738).

Record
MGASA-2021-0271
Updated
2026-11-02
OSVopenSUSE-SU-2021:0153-1 No score

Security update for wavpack

This update for wavpack fixes the following issues:

  • Update to version 5.4.0
    • CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414)
    • fixed: disable A32 asm code when building for Apple silicon
    • fixed: issues with Adobe-style floating-point WAV files
    • added: --normalize-floats option to wvunpack for correctly exporting un-normalized floating-point files
  • Update to version 5.3.0
    • fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448
    • fixed: trailing garbage characters on imported ID3v2 TXXX tags
    • fixed: various minor undefined behavior and memory access issues
    • fixed: sanitize tag extraction names for length and path inclusion
    • improved: reformat wvunpack 'help' and split into long + short versions
    • added: regression testing to Travis CI for OSS-Fuzz crashers
  • Updated to version 5.2.0 *fixed: potential security issues including the following CVEs: CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342),
    CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319
    • added: support for CMake, Travis CI, and Google's OSS-fuzz
    • fixed: use correction file for encode verify (pipe input, Windows)
    • fixed: correct WAV header with actual length (pipe input, -i option)
    • fixed: thumb interworking and not needing v6 architecture (ARM asm)
    • added: handle more ID3v2.3 tag items and from all file types
    • fixed: coredump on Sparc64 (changed MD5 implementation)
    • fixed: handle invalid ID3v2.3 tags from sacd-ripper
    • fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0153-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0154-1 No score

Security update for wavpack

This update for wavpack fixes the following issues:

  • Update to version 5.4.0
    • CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414)
    • fixed: disable A32 asm code when building for Apple silicon
    • fixed: issues with Adobe-style floating-point WAV files
    • added: --normalize-floats option to wvunpack for correctly exporting un-normalized floating-point files
  • Update to version 5.3.0
    • fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448
    • fixed: trailing garbage characters on imported ID3v2 TXXX tags
    • fixed: various minor undefined behavior and memory access issues
    • fixed: sanitize tag extraction names for length and path inclusion
    • improved: reformat wvunpack 'help' and split into long + short versions
    • added: regression testing to Travis CI for OSS-Fuzz crashers
  • Updated to version 5.2.0 *fixed: potential security issues including the following CVEs: CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342),
    CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319
    • added: support for CMake, Travis CI, and Google's OSS-fuzz
    • fixed: use correction file for encode verify (pipe input, Windows)
    • fixed: correct WAV header with actual length (pipe input, -i option)
    • fixed: thumb interworking and not needing v6 architecture (ARM asm)
    • added: handle more ID3v2.3 tag items and from all file types
    • fixed: coredump on Sparc64 (changed MD5 implementation)
    • fixed: handle invalid ID3v2.3 tags from sacd-ripper
    • fixed: several corner-case memory leaks

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0154-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11505-1 No score

libwavpack1-32bit-5.4.0-1.6 on GA media

These are all security issues fixed in the libwavpack1-32bit-5.4.0-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11505-1
Updated
2026-11-02
OSVSUSE-SU-2021:0186-1 No score

Security update for wavpack

This update for wavpack fixes the following issues:

  • Update to version 5.4.0
    • CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414)
    • fixed: disable A32 asm code when building for Apple silicon
    • fixed: issues with Adobe-style floating-point WAV files
    • added: --normalize-floats option to wvunpack for correctly exporting un-normalized floating-point files
  • Update to version 5.3.0
    • fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448
    • fixed: trailing garbage characters on imported ID3v2 TXXX tags
    • fixed: various minor undefined behavior and memory access issues
    • fixed: sanitize tag extraction names for length and path inclusion
    • improved: reformat wvunpack 'help' and split into long + short versions
    • added: regression testing to Travis CI for OSS-Fuzz crashers
  • Updated to version 5.2.0 *fixed: potential security issues including the following CVEs: CVE-2018-19840, CVE-2018-19841, CVE-2018-10536 (bsc#1091344), CVE-2018-10537 (bsc#1091343) CVE-2018-10538 (bsc#1091342),
    CVE-2018-10539 (bsc#1091341), CVE-2018-10540 (bsc#1091340), CVE-2018-7254, CVE-2018-7253, CVE-2018-6767, CVE-2019-11498 and CVE-2019-1010319
    • added: support for CMake, Travis CI, and Google's OSS-fuzz
    • fixed: use correction file for encode verify (pipe input, Windows)
    • fixed: correct WAV header with actual length (pipe input, -i option)
    • fixed: thumb interworking and not needing v6 architecture (ARM asm)
    • added: handle more ID3v2.3 tag items and from all file types
    • fixed: coredump on Sparc64 (changed MD5 implementation)
    • fixed: handle invalid ID3v2.3 tags from sacd-ripper
    • fixed: several corner-case memory leaks
Record
SUSE-SU-2021:0186-1
Updated
2026-11-02
OSVSUSE-SU-2021:0929-1 No score

Security update for wavpack

This update for wavpack fixes the following issues:

  • CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414).
Record
SUSE-SU-2021:0929-1
Updated
2026-11-02
OSVSUSE-SU-2021:14669-1 No score

Security update for wavpack

This update for wavpack fixes the following issues:

  • CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples (bsc#1180414).
Record
SUSE-SU-2021:14669-1
Updated
2026-11-02
OSVUSN-4682-1 No score

wavpack vulnerability

It was discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to execute arbitrary code or cause a crash.

Record
USN-4682-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wavpack
Alpine:v3.12
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.13
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.14
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.15
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.16
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.17
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.18
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.19
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.20
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.21
 before 5.4.0-r0
5.4.0-r0
Show 49 moreShow less
Affected packages
PackageAffectedFixed
wavpack
Alpine:v3.22
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.23
 before 5.4.0-r0
5.4.0-r0
wavpack
Alpine:v3.24
 before 5.4.0-r0
5.4.0-r0
wavpack
Debian:12
 before 5.3.0-2
5.3.0-2
wavpack
Debian:13
 before 5.3.0-2
5.3.0-2
wavpack
Debian:14
 before 5.3.0-2
5.3.0-2
wavpack
Debian:9
From an advisory covering 7 CVEs
 before 5.0.0-2+deb9u3, plus listed versions
5.0.0-25.0.0-2+deb9u15.0.0-2+deb9u2
5.0.0-2+deb9u3
wavpack
Mageia:7
 before 5.1.0-4.2.mga7
5.1.0-4.2.mga7
wavpack
openEuler:20.03-LTS
 before 5.3.0-2.oe1
5.3.0-2.oe1
wavpack
openEuler:20.03-LTS-SP1
 before 5.3.0-2.oe1
5.3.0-2.oe1
wavpack
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Manager Proxy 4.0
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Manager Server 4.0
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:Enterprise Storage 6
From an advisory covering 13 CVEs
 before 5.4.0-4.9.1
5.4.0-4.9.1
wavpack
SUSE:HPE Helion OpenStack 8
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:OpenStack Cloud 7
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:OpenStack Cloud 8
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:OpenStack Cloud 9
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:OpenStack Cloud Crowbar 8
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:OpenStack Cloud Crowbar 9
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server 12 SP5
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 4.60.99-5.9.1
4.60.99-5.9.1
wavpack
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 4.50.1-1.33.1
4.50.1-1.33.1
wavpack
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 4.50.1-1.33.1
4.50.1-1.33.1
wavpack
Ubuntu:18.04:LTS
 before 5.1.0-2ubuntu1.5, plus listed versions
5.1.0-25.1.0-2ubuntu15.1.0-2ubuntu1.15.1.0-2ubuntu1.25.1.0-2ubuntu1.35.1.0-2ubuntu1.4
5.1.0-2ubuntu1.5
wavpack
Ubuntu:20.04:LTS
 before 5.2.0-1ubuntu0.1, plus listed versions
5.1.0-75.2.0-1
5.2.0-1ubuntu0.1
wavpack
openSUSE:Leap 15.2
From an advisory covering 13 CVEs
 before 5.4.0-lp152.7.3.1
5.4.0-lp152.7.3.1
wavpack
openSUSE:Leap 15.1
From an advisory covering 13 CVEs
 before 5.4.0-lp151.5.6.1
5.4.0-lp151.5.6.1
wavpack
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 5.4.0-1.6
5.4.0-1.6

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35738 is a medium vulnerability (CVSS 6.1) in Wavpack, published December 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in wavpack 5.4.0-r0.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open