https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-2476.htmlhttps://patchthecve.com/cve/CVE-2022-2476.htmlWed, 17 Jun 2026 04:41:58 +0000MEDIUM 5.5: A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x561b47a970c6 bp 0x7fff13952fb0 sp 0x7https://patchthecve.com/cve/CVE-2021-44269.htmlhttps://patchthecve.com/cve/CVE-2021-44269.htmlWed, 17 Jun 2026 04:12:08 +0000MEDIUM 5.5: An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.https://patchthecve.com/cve/CVE-2020-35738.htmlhttps://patchthecve.com/cve/CVE-2020-35738.htmlWed, 17 Jun 2026 03:14:13 +0000MEDIUM 6.1: WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.