PT-2026-26137 · Htslib · Htslib

Daviesrob · Published 2026-01-01 · Updated 2026-03-18 · CVE-2026-31963

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.23.1 HTSlib version 1.22.2 HTSlib version 1.21.1

Description HTSlib is a library used for reading and writing bioinformatics file formats. The issue relates to the CRAM decoder, which has a heap buffer overflow due to improper validation of input data. Specifically, an out-by-one error in a test for CRAM features beyond the extent of the CRAM record sequence can lead to an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploitation of this issue could lead to program crashes or overwriting of data and heap structures, potentially resulting in arbitrary code execution.

Recommendations Update HTSlib to version 1.23.1 or later. For HTSlib version 1.22.2, update to version 1.23.1 or later. For HTSlib version 1.21.1, update to version 1.23.1 or later.

Exploit

Fix

Heap Based Buffer Overflow

Improper Validation of Array Index

Memory Corruption

Weakness Enumeration

CWE-122

CWE-129

CWE-787

Related Identifiers

CVE-2026-31963

GHSA-QGQH-H2Q9-7W3C

Affected Products

Htslib

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31963.json · Exploit
• https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd · Patch
• https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31963 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31963 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31963 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31963 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31963 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31963 · Vendor Advisory
• https://twitter.com/cyberbivash/status/2034368858044109246 · Twitter Post
• https://twitter.com/CVEnew/status/2034365239177933233 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034355187762987140 · Twitter Post