High
Security advisory
A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-6767
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:29 UTC · Revision 1
Source evidence
A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.
osv:CVE-2018-6767
Complete source record
{
"id": "88a3ddc25f816ffc6c04bbe3b9c9edb8c3cfc03078a50d3b566f2da3b3da1412",
"url": "https://osv.dev/vulnerability/CVE-2018-6767",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-6767",
"summary": "A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.",
"evidence": "osv:CVE-2018-6767",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-6767",
"aliases": [
"CVE-2018-6767"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dbry/wavpack",
"type": "GIT",
"events": [
{
"introduced": "9ccc3fe4a37d069137ceabe513a4dd9b0a09c1c2"
},
{
"last_affected": "9ccc3fe4a37d069137ceabe513a4dd9b0a09c1c2"
},
{
"fixed": "d5bf76b5a88d044a1be1d5656698e3ba737167e5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wavpack:wavpack:5.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.1.0"
},
{
"last_affected": "5.1.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "d5bf76b5a88d044a1be1d5656698e3ba737167e5"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"5.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6767.json",
"vanir_signatures": [
{
"id": "CVE-2018-6767-21afebdd",
"digest": {
"length": 3350,
"function_hash": "263282531498135750655387005241491253113"
},
"source": "https://github.com/dbry/wavpack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5",
"target": {
"file": "cli/riff.c",
"function": "WriteRiffHeader"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-6767-425436d3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122770698072746895425604571858897861108",
"45212457360348024014895648397607845411",
"306757845720614398807120686037289651581",
"189935008260172588516344894179104127304",
"21258134232442700981735947227666468476",
"308313439293149598669203147012632073228",
"34157346504924645140827126762940142124",
"264224675448615810057246986260877850295",
"152820474521724108594268589983363128540",
"53746980373106445728210512627530174253",
"272468214117579939834238835106525087874",
"74358158535207047921031699705278146315",
"290202196059928601623745918342671111727",
"94150116975744621444743144601151710427",
"30578780731813446862289910328351829001",
"131417613903382327267998364494283617949",
"169723796906189295446691995513930919643",
"207777476458201937253055144935787826241",
"205268697847916533180193262249793867754",
"264951663282712365318369882325602009532",
"3570949662921749271366517180375541422",
"82036369740132966050910127200514745792",
"291820193339812772482563804837611269581",
"111497835232087498906253055943700687183",
"105247472267150826344707900664792782903",
"205071838862414231441234467835280003847",
"130099435738101504094464123795114847203",
"153968906541079243073161239598313477933",
"85073448318567749009518694551546675269",
"267597455784563671812882208848156970151",
"59468178035662643951486363331311754110",
"287263764264659570245036715633331600508",
"260276215368709617001068531246343848532",
"203166897439121091133604325489027168632",
"261491399266282299135076959503233152835",
"69319490753438541406568133137717206544",
"271711868523835302118891696927990408449",
"261711400549195226352843058772070434460",
"306101966940335056951019161605515692544",
"15544764574183948384319141443817016680"
]
},
"source": "https://github.com/dbry/wavpack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5",
"target": {
"file": "cli/riff.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-6767-cfb04179",
"digest": {
"length": 7847,
"function_hash": "200532218224989547623980334368190566470"
},
"source": "https://github.com/dbry/wavpack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5",
"target": {
"file": "cli/riff.c",
"function": "ParseRiffHeaderConfig"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:44:55Z"
}
}
],
"modified": "2026-10-20T13:44:55.804387985Z",
"provider": "osv",
"references": [
"https://seclists.org/bugtraq/2019/Dec/37",
"https://usn.ubuntu.com/3568-1/",
"https://www.debian.org/security/2018/dsa-4125",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889276",
"https://github.com/dbry/WavPack/issues/27",
"https://github.com/dbry/WavPack/commit/d5bf76b5a88d044a1be1d5656698e3ba737167e5"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "17.10"
},
{
"last_affected": "17.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-6767",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388017,
"published_at": "2018-02-06T22:29:00.21+00:00"
}