Memory Exposure Vulnerability in SAMtools Bioinformatics Software
CVE-2026-31972

6.9MEDIUM

Key Information:

Vendor

Samtools

Status
Samtools
Vendor
CVE Published:
18 March 2026

What is CVE-2026-31972?

SAMtools, a widely used program for processing bioinformatics file formats, contains a vulnerability in its mpileup command. This issue arises when data that is no longer required is prematurely discarded, leading to potential memory access errors. Specifically, an attempt to read from a pointer referencing freed memory may occur, risking leakage of sensitive program state information or causing a crash due to invalid memory access. Users are strongly advised to upgrade to versions 1.21.1 or 1.22 to mitigate this vulnerability, as there are no workarounds available.

Affected Version(s)

samtools < 1.21.1

References

https://github.com/samtools/samtools/security/advisories/...
x_refsource_CONFIRM
https://github.com/samtools/samtools/commit/3036eb9af945f...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.