PT-2026-26141 · Htslib · Htslib

Aviesrob · Published 2026-01-01 · Updated 2026-03-18 · CVE-2026-31965

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions HTSlib versions 1.21.1 through 1.23.1

Description HTSlib is a library used for reading and writing bioinformatics file formats, specifically CRAM, a compressed format for DNA sequence alignment data. A flaw exists in the cram decode slice() function during CRAM record processing, where validation of the reference ID field occurs too late. This allows for two out-of-bounds read operations to potentially occur before the invalid data is detected. While the function reports an error, the leakage of two values to the caller may present an exploitation opportunity, or the program could crash due to invalid memory access.

Recommendations HTSlib version 1.23.1 includes a fix for this issue. HTSlib version 1.22.2 includes a fix for this issue. HTSlib version 1.21.1 includes a fix for this issue.

Exploit

Fix

Improper Validation of Array Index

Out of bounds Read

Weakness Enumeration

CWE-129

CWE-125

Related Identifiers

CVE-2026-31965

GHSA-MQM2-V645-3QHR

Affected Products

Htslib

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31965.json · Exploit
• https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357 · Patch
• https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31965 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31965 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31965 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31965 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31965 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31965 · Vendor Advisory
• https://twitter.com/cyberbivash/status/2034368823311176175 · Twitter Post
• https://twitter.com/CVEnew/status/2034365237022064876 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034360307540168765 · Twitter Post