PT-2026-26142 · Htslib · Htslib

Aviesrob · Published 2026-01-01 · Updated 2026-03-18 · CVE-2026-31966

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions HTSlib versions 1.21.1 through 1.23.1

Description HTSlib is a library used for handling bioinformatics file formats, specifically CRAM, a compressed format for DNA sequence alignment data. A flaw exists in how CRAM records are decoded, specifically within the cram decode seq() function. Insufficient validation of feature data series allows for potential leakage of arbitrary data, including program state information, or a program crash due to access of invalid memory locations. This occurs because the function can copy data from outside the bounds of the stored reference sequence into output buffers used for the CRAM record or the SAM MD tag.

Recommendations HTSlib version 1.23.1 includes a fix for this issue. HTSlib version 1.22.2 includes a fix for this issue. HTSlib version 1.21.1 includes a fix for this issue.

Exploit

Fix

Improper Validation of Array Index

Out of bounds Read

Weakness Enumeration

CWE-129

CWE-125

Related Identifiers

CVE-2026-31966

GHSA-5CJ8-MJ52-8VP3

Affected Products

Htslib

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31966.json · Exploit
• https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4 · Patch
• https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3 · Vendor Advisory
• https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28 · Patch
• https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3 · Patch
• https://osv.dev/vulnerability/CVE-2026-31966 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31966 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31966 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31966 · Security Note
• https://ubuntu.com/security/CVE-2026-31966 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31966 · Security Note
• https://twitter.com/CVEnew/status/2034365235877036435 · Twitter Post