Libwav Project maintains a narrowly scoped audio-processing library whose prominence in the vulnerability landscape outweighs its small product count, reflecting deep embedding across multimedia and media-player applications. The recurring weakness classes—NULL-pointer dereferences, infinite-loop conditions, and use of uninitialized resources—are characteristic of memory-handling and control-flow issues that can arise in audio parsing and codec implementations. Defenders should inventory downstream products bundling this library and treat patches as priority for any application that accepts untrusted audio input; current exploitation and severity figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Libwav Project over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-14051HIGH The function wav_read in libwav.c in libwav through 2017-04-20 has an infinite loop. | Jul 13, 2018 | 7.5 | 24 | NO | NO |
CVE-2019-19698MEDIUM marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c. | Dec 10, 2019 | 6.5 | 22 | NO | NO |
CVE-2019-16348MEDIUM marc-q libwav through 2017-04-20 has a NULL pointer dereference in gain_file() at wav_gain.c. | Sep 16, 2019 | 6.5 | 21 | NO | NO |
CVE-2018-14549MEDIUM An issue has been found in libwav through 2017-04-20. It is a SEGV in the function wav_write in libwav.c. | Jul 23, 2018 | 6.5 | 21 | NO | NO |
CVE-2018-14052MEDIUM An issue has been found in libwav through 2017-04-20. It is a SEGV in the function apply_gain in wav_gain/wav_gain.c. | Jul 13, 2018 | 6.5 | 21 | NO | NO |
CVE-2018-14049MEDIUM An issue has been found in libwav through 2017-04-20. It is a SEGV in the function print_info in wav_info/wav_info.c. | Jul 13, 2018 | 6.5 | 21 | NO | NO |
CVE-2018-14050MEDIUM An issue has been found in libwav through 2017-04-20. It is a SEGV in the function wav_free in libwav.c. | Jul 13, 2018 | 6.5 | 20 | NO | NO |
CVE-2022-28488HIGH The function wav_format_write in libwav.c in libwav through 2017-04-20 has an Use of Uninitialized Variable vulnerability. | May 4, 2022 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Libwav Project.
Media articles that mention a CVE ID that affects a product developed by Libwav Project — matched by CVE ID, not by vendor name.