CVE-2026-31968

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.23.1 HTSlib version 1.22.2 HTSlib version 1.21.1

Description HTSlib is a library used for reading and writing bioinformatics file formats. A flaw exists in the handling of VARINT and CONST encodings within the CRAM compressed format. Insufficient validation of the encoding context can lead to heap or stack buffer overflows, potentially allowing for arbitrary code execution. Specifically, up to eight bytes may be written beyond allocated memory regions, potentially overwriting adjacent variables or altering program control flow. Exploitation requires a specially crafted file.

Recommendations Update HTSlib to version 1.23.1 or later. Update HTSlib to version 1.22.2. Update HTSlib to version 1.21.1.