CVE-2018-7254

This flaw is in WavPack’s ability to read a certain kind of audio file (CAF). If an attacker gives you a specially crafted CAF file, the software can crash while trying to parse it—like receiving a corrupted instruction manual that causes the reader to malfunction. In worst cases, it may also behave incorrectly in memory, which is why patching matters.

This affects anyone who runs or packages WavPack 5.1.0 and uses its CLI parsing for CAF files that may be provided by others (for example, user uploads or files coming from outside your control). It’s not listed as requiring authentication, but it does require someone to have the malicious file processed (user interaction). The exposure depends on whether you can reach the affected code path by feeding WavPack a malicious CAF file (reachability from the internet and default reachability are not known from the provided findings).

Treat this as AMBER: there is at least one public exploit available, meaning the bug has known weaponized paths. While it requires user interaction (processing a malicious CAF file), the impact includes denial-of-service and potentially worse memory handling. Act by upgrading or blocking untrusted CAF processing as soon as feasible.

Confirm exposure:

• Identify the installed WavPack version(s) on servers and any conversion/transcoding machines (especially where a CLI tool is used for “import/convert/preview” of uploaded audio).
• Determine whether those systems ever process attacker-controlled CAF files (uploads, attachments, shared-folder inputs, or partner-provided media).

Check for vulnerable version:

• If any environment is running WavPack 5.1.0, it’s in scope.
• If you use distribution packages, verify the packaged version corresponds to the vulnerable 5.1.0 release.

Upgrade / patch:

• Upgrade WavPack to a version that includes the vendor fix commit: 8e3fe45a7bac31d9a3b558ae0079e2d92a04799e.
• If you maintain an internal build, rebase or rebuild WavPack using that commit.
• If you rely on a distro package, update to the next available package release that includes that fix.

Workaround if patching is delayed:

• Prevent untrusted CAF files from being processed by the vulnerable WavPack 5.1.0 directly.
• Practical options:
  • Block .caf uploads/conversion until patched.
  • Route conversion through a controlled, isolated process/environment (containment) so a crash doesn’t take down your core services.

What to monitor:

• Look for repeated failures/crashes around audio parsing/conversion jobs involving .caf files.
• Review job logs for Parse/CAF-related errors and sudden termination of conversion processes after receiving new media files.

Severity and status:

• Classified as HIGH by the provided CVSS, but traffic-light verdict is AMBER.
• No CISA KEV listing was provided.
• Public exploits exist (2 known), indicating exploit maturity beyond theory.

Mechanism:

• A crafted CAF file can trigger a global buffer over-read in ParseCaffHeaderConfig (cli/caff.c) within WavPack 5.1.0.
• The findings also note the possibility of triggering a buffer overflow or incorrect memory allocation paths.

Attack vector and prerequisites (from findings):

• Authentication is not required.
• User interaction is required (someone must provide/trigger processing of the malicious CAF file).
• Reachability in the default configuration is not known from the findings, so exposure depends on whether your workflow feeds untrusted CAF inputs into this code path.

EPSS:

• A predicted likelihood exists in the findings, but because exploitation is confirmed to have public exploits available, remediation priority should be based on the exploit availability rather than the prediction value.