crates.io wasapi vulnerabilities

Latest crates.io wasapi CVEs

Newest publication first

1. RUSTSEC-2026-0332 `WaveFormat::parse` reads past the end of a `&WAVEFORMATEX`

   Published 2026-09-08

   Unknown

   WaveFormat::parse is a safe function that takes a &WAVEFORMATEX, which is only valid for reads of size_of::<WAVEFORMATEX>() (18) bytes. When the header has wFormatTag == WAVE_FORMAT_EXTENSIBLE and cbSize >= 22, the function reinterprets the reference as a WAVEFORMATEXTENSIBLE and...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.