Heap Out-of-Bounds Vulnerability in HTSlib by Samtools
CVE-2026-116742

4.8MEDIUM

Key Information:

Vendor

Samtools

Status
Htslib
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116742?

HTSlib versions up to 1.24 feature a vulnerability in the bgzf_index_load_hfile() function, located in bgzf.c, that can lead to heap memory corruption. By providing a crafted .gzi index entry count, an attacker can manipulate the memory allocation process. A specific count of 0xFFFFFFFF can cause the system to truncate noffs to zero, allowing for memory writes beyond bounds of a malloc(0) buffer. This results in a significant risk of crashing crucial tools like samtools and bcftools, compromising data integrity and operational functionality.

Affected Version(s)

htslib 0 <= 1.24

References

https://github.com/samtools/htslib/pull/2057
issue-trackingpatch
https://github.com/samtools/htslib/commit/18dddf02bb2c005...
patch
https://github.com/samtools/htslib
product

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
daviesrob
.