NULL Pointer Dereference in SAMtools Affects Bioinformatics Data Processing
CVE-2026-31973

6.9MEDIUM

Key Information:

Vendor

Samtools

Status
Samtools
Vendor
CVE Published:
18 March 2026

What is CVE-2026-31973?

A vulnerability in SAMtools beginning with version 1.17 allows for a NULL pointer dereference when using the cram-size command due to a missing check in the cram_decode_compression_header() function. This could lead to unexpected crashes when handling CRAM files. Versions 1.23.1, 1.22.2, and 1.21.1 have addressed this issue with patches. Users are advised to upgrade to these versions to prevent disruptions in bioinformatics data management and processing.

Affected Version(s)

samtools >= 1.17, < 1.21.1 < 1.17, 1.21.1

samtools >= 1.22, < 1.22.2 < 1.22, 1.22.2

samtools = 1.23 = 1.23

References

https://github.com/samtools/samtools/security/advisories/...
x_refsource_CONFIRM
https://github.com/samtools/samtools/commit/06fc2a219b3d7...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.