CVE-2018-7254: Buffer Overflow
Last updated 25 August 2025
Other sources
The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wavpackto a version that resolves this vulnerability.Fixed in 5.4.0-1Fixed in 5.6.0-1Fixed in 5.8.1-1Fixed in 5.9.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7254?
CVE-2018-7254 has been classified as a vulnerability that can lead to denial-of-service and potential buffer overflow issues.
How do I fix CVE-2018-7254?
To remediate CVE-2018-7254, upgrade WavPack to version 5.1.0-2ubuntu0.2 or later for Ubuntu, or to version 5.4.0-1, 5.6.0-1, or 5.7.0-1 for Debian.
What types of systems are affected by CVE-2018-7254?
CVE-2018-7254 affects WavPack 5.1.0 on Ubuntu and multiple versions of WavPack on Debian systems.
Can CVE-2018-7254 lead to data loss?
While CVE-2018-7254 primarily causes denial-of-service, it may indirectly result in data loss under certain exploit scenarios.
What is the attack vector for CVE-2018-7254?
The vulnerability CVE-2018-7254 can be exploited by a remote attacker using a crafted CAF file.