CVE-2020-35738: Debian Linux

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Wavpack Wavpack: version 5.3.0 only

Published 2020-12-28. Last modified 2026-06-17.