PT-2026-26143 · Htslib · Htslib

Aviesrob

·

Publicado

2026-01-01

·

Atualizado

2026-03-18

·

CVE-2026-31967

CVSS v3.1

9.1

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions HTSlib versions 1.21.1 through 1.23.1
Description HTSlib is a library used for handling bioinformatics file formats, specifically CRAM, a compressed DNA sequence alignment data format. A flaw exists in the cram decode slice() function during CRAM record processing where the mate reference ID field is not properly validated. This lack of validation can lead to out-of-bounds array reads when converting data to SAM format. If the resulting array value is a valid pointer, it may be interpreted as a string, potentially leading to information disclosure regarding program state or a program crash due to invalid memory access.
Recommendations Update HTSlib to a version after 1.23.1.

Exploit

Correção

Improper Validation of Array Index

Out of bounds Read

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-129CWE-125

Identificadores relacionados

CVE-2026-31967
GHSA-33X5-C6VJ-8F2W

Produtos afetados

Htslib