Uninitialized Value Vulnerability in WavPack Package
Summary
OSV-2025-124: Use-of-uninitialized-value in get_word. Affects wavpack versions >= b7b796375293defeae340e83d066efa33fa0d2f3, < c3fd0514a45fb79096105c64205ae98cd607755e. Fixed in c3fd0514a45fb79096105c64205ae98cd607755e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WavPack is an open-source audio compression format that provides lossless and lossy compression. It is widely used for its efficiency and quality in audio encoding. However, like many software packages, it can be susceptible to vulnerabilities that may affect its performance and security. The specific vulnerability in question arises from the use of uninitialized values in the 'get_word' function, which can lead to unexpected behavior or crashes.
Vulnerability Detail
The vulnerability identified as OSV-2025-124 is a use-of-uninitialized-value issue that occurs in the 'get_word' function of the WavPack package. This flaw was reported through OSS-Fuzz, a service that finds vulnerabilities in open-source software. When the function is called, it may operate on uninitialized memory, leading to potential crashes or unpredictable behavior. The ramifications of this vulnerability can range from application crashes to potential exploitation if an attacker can manipulate the input to the affected function.
How To Fix
Minimum fixed version
c3fd0514a45fb79096105c64205ae98cd607755e
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function until they have updated to the patched version. Additionally, ensuring that inputs to the 'get_word' function are properly initialized before use may help mitigate the risk of crashes.
Conclusion
The WavPack package has a vulnerability related to the use of uninitialized values in the 'get_word' function, which can lead to crashes. It is crucial for users to update to the patched version to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for wavpack →
FAQ
The vulnerability is a use-of-uninitialized-value issue that can lead to crashes in the WavPack package.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences may include application crashes and unpredictable behavior, which could impact user experience.
Yes, a patch is available. Users should update to the fixed version of the WavPack package.
You can update the package by cloning the repository and checking out the fixed commit as described in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for wavpack.
