PT-2026-26142 · Htslib · Htslib

Aviesrob · Publicado 2026-01-01 · Atualizado 2026-03-18 · CVE-2026-31966

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions HTSlib versions 1.21.1 through 1.23.1

Description HTSlib is a library used for handling bioinformatics file formats, specifically CRAM, a compressed format for DNA sequence alignment data. A flaw exists in how CRAM records are decoded, specifically within the cram decode seq() function. Insufficient validation of feature data series allows for potential leakage of arbitrary data, including program state information, or a program crash due to access of invalid memory locations. This occurs because the function can copy data from outside the bounds of the stored reference sequence into output buffers used for the CRAM record or the SAM MD tag.

Recommendations HTSlib version 1.23.1 includes a fix for this issue. HTSlib version 1.22.2 includes a fix for this issue. HTSlib version 1.21.1 includes a fix for this issue.

Exploit

Correção

Improper Validation of Array Index

Out of bounds Read

Enumeração de Fraquezas

CWE-129

CWE-125

Identificadores relacionados

CVE-2026-31966

GHSA-5CJ8-MJ52-8VP3

Produtos afetados

Htslib

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31966.json · Exploit
• https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4 · Correção
• https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3 · Aviso do Fabricante
• https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28 · Correção
• https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3 · Correção
• https://osv.dev/vulnerability/CVE-2026-31966 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31966 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31966 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-31966 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31966 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034365235877036435 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-31966 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-31966 · Nota de Segurança