PT-2026-26137 · Htslib · Htslib

Daviesrob · Publicado 2026-01-01 · Atualizado 2026-03-18 · CVE-2026-31963

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.23.1 HTSlib version 1.22.2 HTSlib version 1.21.1

Description HTSlib is a library used for reading and writing bioinformatics file formats. The issue relates to the CRAM decoder, which has a heap buffer overflow due to improper validation of input data. Specifically, an out-by-one error in a test for CRAM features beyond the extent of the CRAM record sequence can lead to an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploitation of this issue could lead to program crashes or overwriting of data and heap structures, potentially resulting in arbitrary code execution.

Recommendations Update HTSlib to version 1.23.1 or later. For HTSlib version 1.22.2, update to version 1.23.1 or later. For HTSlib version 1.21.1, update to version 1.23.1 or later.

Exploit

Correção

Heap Based Buffer Overflow

Improper Validation of Array Index

Memory Corruption

Enumeração de Fraquezas

CWE-122

CWE-129

CWE-787

Identificadores relacionados

CVE-2026-31963

GHSA-QGQH-H2Q9-7W3C

Produtos afetados

Htslib

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31963.json · Exploit
• https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd · Correção
• https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2034368858044109246 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034365239177933233 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31963 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-31963 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31963 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-31963 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034355187762987140 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-31963 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31963 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31963 · Aviso do Fabricante