PT-2026-26136 · Htslib · Htslib

Daviesrob · Published 2026-01-01 · Updated 2026-03-28 · CVE-2026-31962

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.23.1

Description HTSlib is a library used for reading and writing bioinformatics file formats. A heap buffer overflow exists in the cram decode seq() function when decoding CRAM files. This occurs because the function incorrectly handles records that omit DNA sequence and quality values, leading to a read and write operation beyond the bounds of a heap allocation. Exploitation of this issue, through a crafted CRAM file, could lead to program crashes, data corruption, or potentially arbitrary code execution.

Recommendations Update to HTSlib version 1.23.1 or later.

Exploit

Fix

Improper Validation of Array Index

Out of bounds Read

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-129

CWE-125

CWE-787

CWE-122

Related Identifiers

CVE-2026-31962

GHSA-XXMP-V7H3-GPWP

Affected Products

Htslib

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31962.json · Exploit
• https://github.com/samtools/htslib/commit/d799b54c6401879187bba4741be83ff590ac73e3 · Patch
• https://github.com/samtools/htslib/security/advisories/GHSA-xxmp-v7h3-gpwp · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31962 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31962 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31962 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31962 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31962 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31962 · Security Note
• https://twitter.com/VulmonFeeds/status/2034444803245518924 · Twitter Post
• https://twitter.com/CVEnew/status/2034365241132503231 · Twitter Post
• https://twitter.com/Cezar_H_Linux/status/2037921173686665300 · Twitter Post
• https://twitter.com/threatcluster/status/2037801938348114300 · Twitter Post