PT-2026-26144 · Htslib · Htslib

Daviesrob · Published 2026-01-01 · Updated 2026-03-18 · CVE-2026-31968

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HTSlib versions prior to 1.23.1 HTSlib version 1.22.2 HTSlib version 1.21.1

Description HTSlib is a library used for reading and writing bioinformatics file formats. A flaw exists in the handling of VARINT and CONST encodings within the CRAM compressed format. Insufficient validation of the encoding context can lead to heap or stack buffer overflows, potentially allowing for arbitrary code execution. Specifically, up to eight bytes may be written beyond allocated memory regions, potentially overwriting adjacent variables or altering program control flow. Exploitation requires a specially crafted file.

Recommendations Update HTSlib to version 1.23.1 or later. Update HTSlib to version 1.22.2. Update HTSlib to version 1.21.1.

Exploit

Fix

Heap Based Buffer Overflow

Type Confusion

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-843

CWE-121

CWE-787

Related Identifiers

CVE-2026-31968

GHSA-CGCM-C9R2-P57J

Affected Products

Htslib

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31968.json · Exploit
• https://github.com/samtools/htslib/commit/0ec436796eca7b4ce7fcc9b77270c102da29bb2e · Patch
• https://github.com/samtools/htslib/security/advisories/GHSA-cgcm-c9r2-p57j · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31968 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31968 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31968 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31968 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31968 · Vendor Advisory
• https://twitter.com/CVEnew/status/2034365233670860976 · Twitter Post