Out of Bounds Read Vulnerability in HTSlib Library for Bioinformatics Data
CVE-2026-31965

6.9MEDIUM

Key Information:

Vendor

Samtools

Status
Htslib
Vendor
CVE Published:
18 March 2026

What is CVE-2026-31965?

HTSlib, a library used for handling bioinformatics file formats, features a vulnerability in the cram_decode_slice() function. This vulnerability arises from the improper validation of the reference ID field, which occurs too late in the process. Consequently, this leads to two out of bounds reads before the function detects the invalid data. Though the function reports an error, which may hinder exploitation attempts, it could potentially result in memory leaks. Moreover, there is a risk that the program might crash due to attempts to access invalid memory regions. The affected versions 1.23.1, 1.22.2, and 1.21.1 have been patched to rectify this issue, and no workaround is available.

Affected Version(s)

htslib < 1.21.1 < 1.21.1

htslib >= 1.22, < 1.22.2 < 1.22, 1.22.2

htslib = 1.23 = 1.23

References

https://github.com/samtools/htslib/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/samtools/htslib/commit/9cefb46453ad471...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.