CVE-2016-10169
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a...
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10169- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10169- Updated
- 2026-11-02
EUVDEUVD-2016-1357 No score
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
EUVD-2016-1357- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v2fw-mf5r-pfvv
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a...
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
GHSA-v2fw-mf5r-pfvv- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2016-10169
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
ALPINE-CVE-2016-10169- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
CVE-2016-10169- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2016-10169
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
DEBIAN-CVE-2016-10169- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10169
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
- Record
UBUNTU-CVE-2016-10169- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0077 No score
Updated wavpack packages fix security vulnerability
Hanno Böck discovered a global buffer overread vulnerability in WavPack's word parsing logic (CVE-2016-10169), this update fixes it.
- Record
MGASA-2017-0077- Updated
- 2026-11-02
OSVSUSE-SU-2018:0607-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172: Make sure upper and lower boundaries make sense, to avoid out of bounds memory reads that could lead to crashes or disclosing memory. (bsc#1021483)
- Record
SUSE-SU-2018:0607-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0608-1 No score
Security update for wavpack
This update for wavpack fixes the following issues:
- CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172: Make sure upper and lower boundaries make sense, to avoid out of bounds memory reads that could lead to crashes or disclosing memory. (bsc#1021483)
- Record
SUSE-SU-2018:0608-1- Updated
- 2026-11-02
OSVUSN-3568-1 No score
wavpack vulnerabilities
Hanno Böck discovered that WavPack incorrectly handled certain WV files. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10169)
Joonun Jang discovered that WavPack incorrectly handled certain RF64 files. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 17.10. (CVE-2018-6767)
- Record
USN-3568-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wavpackAlpine:v3.10 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.11 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.12 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.13 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.14 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.15 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.16 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.17 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.18 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.19 |
before 5.1.0-r0 | 5.1.0-r0 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wavpackAlpine:v3.2 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.20 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.21 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.22 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.23 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.24 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.3 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.4 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.5 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.6 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.7 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.8 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackAlpine:v3.9 |
before 5.1.0-r0 | 5.1.0-r0 |
wavpackDebian:12 |
before 5.0.0-2 | 5.0.0-2 |
wavpackDebian:13 |
before 5.0.0-2 | 5.0.0-2 |
wavpackDebian:14 |
before 5.0.0-2 | 5.0.0-2 |
wavpackMageia:5 |
before 4.70.0-3.1.mga5 | 4.70.0-3.1.mga5 |
wavpackSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Server 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 4.50.1-1.27.1 | 4.50.1-1.27.1 |
wavpackSUSE:Linux Enterprise Desktop 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Desktop 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 4.60.99-5.3.1 | 4.60.99-5.3.1 |
wavpackUbuntu:14.04:LTS |
before 4.70.0-1ubuntu0.1, plus listed versions 4.60.1-34.70.0-1 |
4.70.0-1ubuntu0.1 |
wavpackUbuntu:16.04:LTS |
before 4.75.2-2ubuntu0.1, plus listed versions 4.75.0-14.75.2-2 |
4.75.2-2ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10169 is a medium vulnerability (CVSS 5.5) in Wavpack Project Wavpack, published March 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in wavpack 5.1.0-r0.
References
securityfocus.com/bid/95883
sourceforge.net/p/wavpack/mailman/message/35557889
openwall.com/lists/oss-security/2017/01/28/9
usn.ubuntu.com/3568-1
github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc
nvd.nist.gov/vuln/detail/CVE-2016-10169
Show 17 moreShow less
security.alpinelinux.org/vuln/CVE-2016-10169
security-tracker.debian.org/tracker/CVE-2016-10169
advisories.mageia.org/MGASA-2017-0077.html
bugs.mageia.org/show_bug.cgi?id=20205
openwall.com/lists/oss-security/2017/01/23/4
suse.com/support/update/announcement/2018/suse-su-20180607-1
bugzilla.suse.com/1021483
ubuntu.com/security/CVE-2016-10169
cve.org/CVERecord?id=CVE-2016-10169