CVE-2026-116742

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.25

Description A heap out-of-bounds write and read issue exists in the bgzf index load hfile() function within bgzf.c. An attacker can corrupt heap memory by providing a specially crafted .gzi index entry count. Specifically, a count of 0xFFFFFFFF truncates the noffs variable to zero, which leads to writes beyond a malloc(0) buffer and an offs[-1] read in the bgzf useek() function. This can result in heap corruption or system crashes in associated tools such as samtools and bcftools.

Recommendations Update HTSlib to version 1.25 or later.