#VU19226 Input validation error in WavPack - CVE-2019-11498

Vulnerability identifier: #VU19226

Vulnerability risk: Low

CVSSv4.0: 3.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-11498

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
WavPack
Client/Desktop applications / Multimedia software

Vendor: wavpack

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the WavpackSetConfiguration64() function in the pack_utils.c file within the libwavpack.a. A remote attacker can trick the victim to open a specially crafted DFF file that lacks valid sample-rate data and crash the affected application. 

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

WavPack: 4.1 - 5.1.0

---

External links
https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4
https://github.com/dbry/WavPack/issues/67

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.