Buffer Overflow Vulnerability in HTSlib Bioinformatics Library
CVE-2026-31966
6.9MEDIUM
What is CVE-2026-31966?
HTSlib, a crucial library for bioinformatics, contains a buffer overflow vulnerability during CRAM data decoding. Insufficient validation of feature data allows the cram_decode_seq() function to inadvertently copy data from invalid memory locations, leading to potential information leaks about the program state or even crashes due to unauthorized memory access. To protect systems and data, it is essential to update to versions 1.23.1, 1.22.2, or 1.21.1 where this issue has been resolved.
Affected Version(s)
htslib < 1.21.1 < 1.21.1
htslib >= 1.22, < 1.22.2 < 1.22, 1.22.2
htslib = 1.23 = 1.23