{"id":"CVE-2022-2476","aliases":["AZL-10317","CLSA-2026-1784814430","CLSA-2026-1785754254","DEBIAN-CVE-2022-2476","EUVD-2022-34735","GHSA-62q3-hj99-8qw6","MGASA-2022-0291","OESA-2024-2514","OESA-2024-2515","OESA-2024-2516","OESA-2024-2517","SUSE-SU-2022:2681-1","SUSE-SU-2022:2682-1","UBUNTU-CVE-2022-2476","USN-5721-1"],"status":"published","title":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log:...","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00376,"percentile":0.31835,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-07-19T00:00:00Z","modified":"2026-11-06T13:49:33Z","fixes":[{"ecosystem":"Azure Linux:2","package":"wavpack","fixed_in":["5.6.0-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"wavpack","fixed_in":["5.4.0-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"wavpack-devel","fixed_in":["5.4.0-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"wavpack","fixed_in":["5.4.0-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"wavpack-devel","fixed_in":["5.4.0-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wavpack","fixed_in":["5.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wavpack","fixed_in":["5.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wavpack","fixed_in":["5.5.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"wavpack","fixed_in":["5.5.0-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"wavpack","fixed_in":["5.3.0-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"wavpack","fixed_in":["5.3.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"wavpack","fixed_in":["5.3.0-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"wavpack","fixed_in":["5.3.0-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"wavpack","fixed_in":["5.4.0-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"wavpack","fixed_in":["5.4.0-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"wavpack","fixed_in":["5.4.0-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"wavpack","fixed_in":["5.4.0-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"wavpack","fixed_in":["5.4.0-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"wavpack","fixed_in":["5.4.0-150000.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"wavpack","fixed_in":["4.60.99-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"wavpack","fixed_in":["4.60.99-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"wavpack","fixed_in":["4.60.99-5.12.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wavpack","fixed_in":["4.75.2-2ubuntu0.2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"wavpack-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"wavpack-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.0-150000.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.60.99-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.60.99-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.60.99-5.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.75.2-2ubuntu0.2+esm1"}]}],"versions":["4.75.0-1","4.75.2-2","4.75.2-2ubuntu0.1","4.75.2-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0-2","5.1.0-2ubuntu1","5.1.0-2ubuntu1.1","5.1.0-2ubuntu1.2","5.1.0-2ubuntu1.3","5.1.0-2ubuntu1.4","5.1.0-2ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0-7","5.2.0-1","5.2.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1build1","5.4.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.0-1","5.9.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.1-1","5.8.1-1build1","5.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wavpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.75.2-2ubuntu0.2+esm1"}]}],"versions":["4.75.0-1","4.75.2-2","4.75.2-2ubuntu0.1","4.75.2-2ubuntu0.2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"wavpack","product":"wavpack"}],"references":[{"url":"https://github.com/dbry/WavPack/issues/121","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CK45CC7MQ54SHEIJ63PW3HP4BCPTX6QP/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMIXZWB3OURGBAEU3T5HQY56BN2ZVLYF/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2476","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CK45CC7MQ54SHEIJ63PW3HP4BCPTX6QP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMIXZWB3OURGBAEU3T5HQY56BN2ZVLYF/"},{"url":"https://github.com/advisories/GHSA-62q3-hj99-8qw6"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784814430.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785754254.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2476.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2476","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0291.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30713","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-August/011810.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ARTEEJRUGSNDT3E2765JKXPXHP2NYLUR/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2514","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2515","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2516","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2517","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222681-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201716","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2476","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222682-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2476","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5721-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2476","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-2476","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-19T00:00:00Z","modified":"2024-08-03T00:39:07.68Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-34735","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-19T00:00:00Z","modified":"2024-08-03T00:39:07Z","updated_at":"2026-11-03T03:25:58.383516Z"}],"ghsa":[{"id":"GHSA-62q3-hj99-8qw6","title":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log:...","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-20T00:00:18Z","modified":"2023-01-29T05:02:40Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:45:08.540426Z"}],"nvd":[{"id":"CVE-2022-2476","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-19T20:15:11.303Z","modified":"2026-06-17T04:41:58.07Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"AZL-10317","title":"CVE-2022-2476 affecting package wavpack for versions less than 5.6.0-1","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-19T20:15:11Z","modified":"2026-04-21T04:18:37.154253Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"OESA-2024-2514","title":"wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.\r\n\r\nSecurity Fix(es):\r\n\r\nA null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)","status":"published","published":"2024-12-06T11:08:00Z","modified":"2026-08-18T01:18:42.589831133Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2515","title":"wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.\r\n\r\nSecurity Fix(es):\r\n\r\nA null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)","status":"published","published":"2024-12-06T11:08:00Z","modified":"2026-08-18T01:18:42.570219611Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2516","title":"wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.\r\n\r\nSecurity Fix(es):\r\n\r\nA null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)","status":"published","published":"2024-12-06T11:08:00Z","modified":"2026-08-18T01:18:42.603921005Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2517","title":"wavpack security update","description":"WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution.\r\n\r\nSecurity Fix(es):\r\n\r\nA null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING(CVE-2022-2476)","status":"published","published":"2024-12-06T11:08:00Z","modified":"2026-08-18T01:18:42.585742652Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2022-2476","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-19T20:15:00Z","modified":"2026-11-06T13:49:33.931030913Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T14:22:04.982785Z"},{"id":"CLSA-2026-1784814430","title":"wavpack: Fix of CVE-2022-2476","description":"- CVE-2022-2476: sanitize alternate extension metadata before constructing output filenames","status":"published","published":"2026-07-23T13:47:35Z","modified":"2026-10-26T09:30:28.195152873Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785754254","title":"wavpack: Fix of CVE-2022-2476","description":"- CVE-2022-2476: NULL guard in wvunpack and sanitize alt-extension metadata","status":"published","published":"2026-08-03T10:51:05Z","modified":"2026-10-26T09:31:22.735212733Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CVE-2022-2476","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-19T00:00:00Z","modified":"2026-10-28T02:30:44.49410659Z","cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-2476","description":"A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7fff1394fca0 T0) ==84257==The signal is caused by a WRITE memory access. ==84257==Hint: address points to the zero page. #0 0x561b47a970c5 in main cli/wvunpack.c:834 #1 0x7efc4f5c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #2 0x561b47a945ed in _start (/usr/local/bin/wvunpack+0xa5ed) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV cli/wvunpack.c:834 in main ==84257==ABORTING","status":"published","published":"2022-07-19T20:15:11.303Z","modified":"2026-11-03T06:02:15.350509084Z","updated_at":"2026-11-03T06:44:05.456691Z"},{"id":"MGASA-2022-0291","title":"Updated wavpack packages fix security vulnerability","description":"Null pointer dereference in wvunpack (CVE-2022-2476)\n","status":"published","published":"2022-08-20T10:04:13Z","modified":"2026-04-16T04:44:35.726236619Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"SUSE-SU-2022:2681-1","title":"Security update for wavpack","description":"This update for wavpack fixes the following issues:\n\n- CVE-2022-2476: Fixed a Null pointer dereference in wvunpack (bsc#1201716).\n","status":"published","published":"2022-08-05T09:20:04Z","modified":"2026-02-04T03:06:31.749935Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2682-1","title":"Security update for wavpack","description":"This update for wavpack fixes the following issues:\n\n- CVE-2022-2476: Fixed a Null pointer dereference in wvunpack (bsc#1201716).\n","status":"published","published":"2022-08-05T09:20:21Z","modified":"2026-02-04T03:49:57.23271Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5721-1","title":"wavpack vulnerability","description":"It was discovered that WavPack was not properly performing checks\nwhen dealing with memory. If a user were tricked into decompressing a\nspecially crafted WavPack Audio File, an attacker could possibly use\nthis issue to cause the WavPack decompressor to crash, resulting in a\ndenial of service.\n","status":"published","published":"2022-11-10T18:47:06Z","modified":"2026-06-25T13:31:32.739024213Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}