CRAM Format Vulnerability in HTSlib Affecting Samtools Products
CVE-2026-31964

6.9MEDIUM

Key Information:

Vendor

Samtools

Status
Htslib
Vendor
CVE Published:
18 March 2026

What is CVE-2026-31964?

HTSlib is a bioinformatics library used for handling file formats like CRAM, which stores DNA sequence alignment data. An issue has been identified where certain encodings—CONST, XPACK, and XRLE—failed to manage alignment records with omitted sequence or quality data correctly. This mishandling can lead to a NULL pointer dereference, resulting in a program crash when attempting to decode such records. Users must update to versions 1.23.1, 1.22.2, or 1.21.1, as no workaround is available for this flaw.

Affected Version(s)

htslib < 1.21.1 < 1.21.1

htslib >= 1.22, < 1.22.2 < 1.22, 1.22.2

htslib = 1.23 = 1.23

References

https://github.com/samtools/htslib/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/samtools/htslib/commit/e64e68da567d230...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.