Uninitialized Value Use in WavPack: Vulnerability OSV-2025-108
Summary
OSV-2025-108: Use-of-uninitialized-value in decimate_dsd_run. Affects wavpack versions >= b7b796375293defeae340e83d066efa33fa0d2f3, < 84b576d2c627418a6453cc986b53e79bed38d653. Fixed in 84b576d2c627418a6453cc986b53e79bed38d653. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that provides lossless and lossy compression. It is widely used for its efficiency in compressing audio files while maintaining high quality. However, like many software packages, it can be susceptible to vulnerabilities that may compromise its functionality and security. The vulnerability identified as OSV-2025-108 pertains to a use-of-uninitialized-value issue in the 'decimate_dsd_run' function, which can lead to crashes and unexpected behavior.
Vulnerability Detail
The vulnerability arises from the use of an uninitialized value in the 'decimate_dsd_run' function within the WavPack codebase. This issue was reported through OSS-Fuzz, a service that identifies vulnerabilities in open-source software. The uninitialized value can lead to crashes during execution, specifically when the function attempts to process audio samples without proper initialization. This can result in application instability and may be exploited to cause denial of service.
How To Fix
Minimum fixed version
84b576d2c627418a6453cc986b53e79bed38d653
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'decimate_dsd_run' function until they have updated to the patched version. This may involve modifying the code to bypass this function or using alternative methods for audio processing that do not invoke this vulnerable function.
Conclusion
The vulnerability OSV-2025-108 in WavPack highlights the importance of maintaining updated software to prevent potential crashes and security issues. Users are encouraged to apply the available patch and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for wavpack →
FAQ
The vulnerability is a use-of-uninitialized-value issue that can lead to crashes during audio processing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The primary consequence is application instability, which can lead to crashes and denial of service.
Yes, a patch is available in the commit '84b576d2c627418a6453cc986b53e79bed38d653'.
If you cannot update immediately, consider avoiding the use of the 'decimate_dsd_run' function as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
