PT-2026-26136

CVE-2026-31962

Published

2026-01-01

Updated

2026-08-30

Description by

CVSS 4.0

8.8

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.23.1

Description HTSlib is a library used for reading and writing bioinformatics file formats. A heap buffer overflow exists in the cram decode seq() function when decoding CRAM files. This occurs because the function incorrectly handles records that omit DNA sequence and quality values, leading to a read and write operation beyond the bounds of a heap allocation. Exploitation of this issue, through a crafted CRAM file, could lead to program crashes, data corruption, or potentially arbitrary code execution.

Recommendations Update to HTSlib version 1.23.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Daviesrob

Vendors

Affected products

Weakness enumeration

CWE-125: Out-of-bounds Read

CWE-787: Out-of-bounds Write