The vulnerability in gst-plugins-good's WavPack decoder arises from an integer overflow in the calculation of buffer size (4 * block_samples * channels) in the gst_wavpack_dec_handle_frame() function. This overflow causes an insufficient heap allocation, followed by out-of-bounds writes of decoded audio samples, resulting in heap memory corruption. Both 32-bit and 64-bit architectures are affected due to the 32-bit arithmetic before size promotion. Exploitation requires a user to open a crafted WavPack audio file, potentially leading to application crashes or arbitrary code execution.

Heap memory corruption can lead to denial of service (application crashes) or potentially arbitrary code execution if exploited successfully. The vulnerability affects both 32-bit and 64-bit systems. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid opening untrusted or suspicious WavPack audio files to mitigate risk.