Dbry · Wavpack · CVE-2019-1010317
**Name of the Vulnerable Software and Affected Versions**
WavPack versions 5.1.0 and earlier
**Description**
The issue is related to the use of uninitialized variables in the ParseCaffHeaderConfig function of the WavPack audio codec. This can be exploited by a remote attacker using a malicious .wav file, potentially leading to unexpected control flow, crashes, and segfaults. The component affected is ParseCaffHeaderConfig in the caff.c file.
**Recommendations**
For WavPack versions 5.1.0 and earlier, update to a version after commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b to resolve the issue. As a temporary workaround, consider avoiding the use of .wav files from untrusted sources to minimize the risk of exploitation.