Heap Buffer Overflow in HTSlib Affecting Bioinformatics Applications

CVE-2026-31970

What is CVE-2026-31970?

HTSlib, a widely used library for reading and writing bioinformatics file formats, has a vulnerability in its GZI file loading function, which can lead to an integer overflow. When bgzf_index_load_hfile() processes GZI index files, the buffer allocated to store the index may be undersized, leading to potential heap corruption due to unintended memory writes. If an attacker crafts a malicious GZI index file, it could result in a program crash or manipulation of application memory, which may allow for arbitrary code execution. Users are advised to remove GZI index files from untrusted sources and utilize the bgzip -r command to regenerate these files securely.

References