Out of Bounds Access Vulnerability in HTSlib Bioinformatics Library
CVE-2026-31967

6.9MEDIUM

Key Information:

Vendor

Samtools

Status
Htslib
Vendor
CVE Published:
18 March 2026

What is CVE-2026-31967?

The HTSlib library, essential for reading and writing bioinformatics file formats, contains a vulnerability in the cram_decode_slice() function. This flaw occurs due to a lack of validation for the mate reference id field when processing CRAM records. Consequently, an out of bounds array access may happen during reference name lookups, which could lead to a potential information leak if the accessed array value is interpreted as a valid pointer. This may also result in application crashes due to attempts to read from invalid memory. The affected versions (1.23.1, 1.22.2, and 1.21.1) have implemented fixes, with no available workaround for prior versions.

Affected Version(s)

htslib < 1.21.1 < 1.21.1

htslib >= 1.22, < 1.22.2 < 1.22, 1.22.2

htslib = 1.23 = 1.23

References

https://github.com/samtools/htslib/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/samtools/htslib/commit/9cefb46453ad471...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.