CVE-2016-10169

What it actually does

Out-of-bounds read in read_code function of read_words.c allows denial of service via crafted WV file.

Why it matters to the business

Processing of audio files in media workflows can be disrupted causing application crashes and operational downtime; low urgency given age and lack of ransomware or KEV usage but widespread in audio toolchains.

How an attack unfolds

Attacker creates a malicious WV file that triggers the read_code out-of-bounds read then supplies the file to a victim application using an affected Wavpack build; processing the file causes the crash. Public exploits exist but no named threat actors are associated.

How to fix it

Upgrade dbry/wavpack to commit 4bc05fc490b66ef2d45b1de26abf1455b486b0dc or later. For gitlab (Bitnami) update to version 13.12.9 or newer.

How to confirm the fix worked

Confirm Wavpack version or commit hash matches a fixed release. Test processing of boundary-case WV files to verify absence of crash.

Typical attack path

1. Craft WV file that triggers read_code out-of-bounds read
2. Deliver file to target via email, web download, or shared storage
3. Victim or automated process opens the file with vulnerable Wavpack library
4. Out-of-bounds read occurs resulting in denial of service

How to detect it

Review application and system logs for Wavpack process crashes or segmentation faults during WV file handling; correlate with timestamps of file processing activity.

What your security team should do

• Apply fixed Wavpack commit or GitLab Bitnami 13.12.9 immediately in all build and runtime environments
• Inventory all uses of Wavpack across development and production pipelines
• Add WV file validation or sandboxing for untrusted audio input where feasible
• Monitor exploit availability and update EPSS trend awareness