{"id":"CVE-2021-44269","aliases":["ALPINE-CVE-2021-44269","ALSA-2022:7558","ALSA-2022:8139","AZL-8977","DEBIAN-CVE-2021-44269","EUVD-2021-31115","GHSA-f35r-5xp5-9859","MGASA-2022-0125","RHSA-2022:7558","RHSA-2022:8139","RLSA-2022:7558","RLSA-2022:8139","SUSE-SU-2022:0954-1","UBUNTU-CVE-2021-44269","openSUSE-SU-2022:0954-1","openSUSE-SU-2024:11938-1"],"status":"published","title":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered...","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.0115,"percentile":0.6734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-03-10T16:13:27Z","modified":"2026-11-06T13:49:16Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"wavpack","fixed_in":["5.5.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"wavpack","fixed_in":["5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"wavpack-devel","fixed_in":["5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"wavpack","fixed_in":["5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"wavpack-devel","fixed_in":["5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"wavpack","fixed_in":["5.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wavpack","fixed_in":["5.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wavpack","fixed_in":["5.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wavpack","fixed_in":["5.5.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"wavpack","fixed_in":["5.3.2-2.1.mga8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wavpack","fixed_in":["0:5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wavpack-debuginfo","fixed_in":["0:5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wavpack-debugsource","fixed_in":["0:5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"wavpack-debuginfo","fixed_in":["0:5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"wavpack-debugsource","fixed_in":["0:5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"wavpack-devel","fixed_in":["0:5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wavpack","fixed_in":["0:5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wavpack-debuginfo","fixed_in":["0:5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wavpack-debugsource","fixed_in":["0:5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"wavpack-debuginfo","fixed_in":["0:5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"wavpack-debugsource","fixed_in":["0:5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"wavpack-devel","fixed_in":["0:5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"wavpack","fixed_in":["0:5.1.0-16.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"wavpack","fixed_in":["0:5.4.0-5.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"wavpack","fixed_in":["5.4.0-4.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"wavpack","fixed_in":["5.4.0-4.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"wavpack","fixed_in":["5.4.0-4.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"wavpack","fixed_in":["5.4.0-4.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"wavpack-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"wavpack-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2-2.1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wavpack-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wavpack-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"wavpack-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"wavpack-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"wavpack-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wavpack-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"wavpack-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"wavpack-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"wavpack-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"wavpack-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.0-16.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0-5.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0-2","5.1.0-2ubuntu1","5.1.0-2ubuntu1.1","5.1.0-2ubuntu1.2","5.1.0-2ubuntu1.3","5.1.0-2ubuntu1.4","5.1.0-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0-7","5.2.0-1","5.2.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1build1","5.4.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.0-1","5.9.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.1-1","5.8.1-1build1","5.9.0-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-4.12.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"wavpack","product":"wavpack"}],"references":[{"url":"https://github.com/dbry/WavPack/issues/110","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRZWZKEEABCLVXZEXQZBIT3ZKLIXVFF5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2CZUFTX3J4Y4OSRITG4PXCI7NRVFDYVQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQKOOJRI2VAPYS3652HVDXON723HTXBP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5B7L26LA6KGX7YH6SWD5CSBNWKV5MBO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I54NXQZELBF42OL4KQZJJRAYZX7IPZXP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44269","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2CZUFTX3J4Y4OSRITG4PXCI7NRVFDYVQ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRZWZKEEABCLVXZEXQZBIT3ZKLIXVFF5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SQKOOJRI2VAPYS3652HVDXON723HTXBP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5B7L26LA6KGX7YH6SWD5CSBNWKV5MBO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I54NXQZELBF42OL4KQZJJRAYZX7IPZXP/"},{"url":"https://github.com/advisories/GHSA-f35r-5xp5-9859"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-44269","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7558","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44269","tags":["report"]},{"url":"https://bugzilla.redhat.com/2064457","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-7558.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8139","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8139.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44269","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0125.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30215","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MA3ZHJ2SJ5F7RD4MVUADLVJ2VXDS4AOS/","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064457","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7558.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44269","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8139.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:7558","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8139","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220954-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197020","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44269","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-44269","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-44269","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T16:13:27Z","modified":"2024-08-04T04:17:24.921Z","updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-31115","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T16:13:27Z","modified":"2024-08-04T04:17:24Z","updated_at":"2026-11-03T03:24:12.005069Z"}],"ghsa":[{"id":"GHSA-f35r-5xp5-9859","title":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered...","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-11T00:02:27Z","modified":"2023-01-27T05:00:53Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:41:46.4155Z"}],"nvd":[{"id":"CVE-2021-44269","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T17:44:14.923Z","modified":"2026-06-17T04:12:08.113Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:05.198719Z"}],"osv":[{"id":"ALPINE-CVE-2021-44269","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T17:44:14.923Z","modified":"2026-11-03T06:31:48.548586943Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"AZL-8977","title":"CVE-2021-44269 affecting package wavpack for versions less than 5.6.0-1","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T17:44:14Z","modified":"2026-04-21T04:34:56.549512Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"CVE-2021-44269","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T17:44:14.923Z","modified":"2026-10-20T10:55:05.305405478Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-44269","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T17:44:14.923Z","modified":"2026-10-23T18:04:16.973378675Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"RHSA-2022:7558","title":"Red Hat Security Advisory: wavpack security update","status":"published","published":"2024-09-16T08:10:07Z","modified":"2026-06-26T12:22:18.672998839Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8139","title":"Red Hat Security Advisory: wavpack security update","status":"published","published":"2024-09-16T08:10:15Z","modified":"2026-06-26T12:22:29.800284117Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:7558","title":"Low: wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy and a unique hybrid compression mode. \n\nSecurity Fix(es):\n\n* wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.","status":"published","published":"2022-11-08T06:22:38Z","modified":"2026-02-04T13:30:08.776057Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:8139","title":"Low: wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. \n\nSecurity Fix(es):\n\n* wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.","status":"published","published":"2022-11-15T06:16:36Z","modified":"2025-10-09T05:47:15.30493Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-44269","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.","status":"published","published":"2022-03-10T17:44:00Z","modified":"2026-11-06T13:49:16.421306616Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T14:21:59.241576Z"},{"id":"ALSA-2022:7558","title":"Low: wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy and a unique hybrid compression mode. \n\nSecurity Fix(es):\n\n* wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2026-10-29T11:01:07.941827743Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:8139","title":"Low: wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. \n\nSecurity Fix(es):\n\n* wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:18.35651383Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"MGASA-2022-0125","title":"Updated wavpack packages fix security vulnerability","description":"An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV\nfiles. This issue triggered in function WavpackPackSamples of file\nsrc/pack_utils.c, tainted variable cnt is too large, that makes pointer\nsptr read beyond heap bound. (CVE-2021-44269)\n","status":"published","published":"2022-03-31T19:55:37Z","modified":"2026-04-16T04:44:19.983268173Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0954-1","title":"Security update for wavpack","description":"This update for wavpack fixes the following issues:\n\n- CVE-2021-44269: Fixed out of bounds read in processing .wav files (bsc#1197020).\n","status":"published","published":"2022-03-28T07:22:06Z","modified":"2026-02-04T03:52:20.472304Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11938-1","title":"libwavpack1-32bit-5.4.0-2.1 on GA media","description":"These are all security issues fixed in the libwavpack1-32bit-5.4.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:15:05.144777Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:0954-1","title":"Security update for wavpack","description":"This update for wavpack fixes the following issues:\n\n- CVE-2021-44269: Fixed out of bounds read in processing .wav files (bsc#1197020).\n","status":"published","published":"2022-03-28T07:21:54Z","modified":"2026-02-04T03:28:11.960609Z","updated_at":"2026-11-02T15:53:50.066806Z"}]}}