PT-2026-26136 · Htslib · Htslib

Daviesrob · Publicado 2026-01-01 · Atualizado 2026-06-05 · CVE-2026-31962

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.23.1

Description HTSlib is a library used for reading and writing bioinformatics file formats. A heap buffer overflow exists in the cram decode seq() function when decoding CRAM files. This occurs because the function incorrectly handles records that omit DNA sequence and quality values, leading to a read and write operation beyond the bounds of a heap allocation. Exploitation of this issue, through a crafted CRAM file, could lead to program crashes, data corruption, or potentially arbitrary code execution.

Recommendations Update to HTSlib version 1.23.1 or later.

Exploit

Correção

Improper Validation of Array Index

Out of bounds Read

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-129

CWE-125

CWE-787

CWE-122

Identificadores relacionados

CVE-2026-31962

GHSA-XXMP-V7H3-GPWP

OESA-2026-2547

Produtos afetados

Htslib

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31962.json · Exploit
• https://github.com/samtools/htslib/security/advisories/GHSA-xxmp-v7h3-gpwp · Aviso do Fabricante
• https://github.com/samtools/htslib/commit/d799b54c6401879187bba4741be83ff590ac73e3 · Correção
• https://cve.org/CVERecord?id=CVE-2026-31962 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034365241132503231 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31962 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2026-2547 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31962 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31962 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-31962 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034444803245518924 · Publicação no Twitter
• https://twitter.com/Cezar_H_Linux/status/2037921173686665300 · Publicação no Twitter
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2547 · Nota
• https://twitter.com/threatcluster/status/2037801938348114300 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-31962 · Aviso do Fabricante