PT-2026-26153 · Samtools · Samtools

Aviesrob · Published 2026-03-18 · Updated 2026-03-19 · CVE-2026-31972

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAMtools versions prior to 1.21.1 SAMtools versions prior to 1.22

Description SAMtools is a program used for bioinformatics file manipulation. The mpileup command, which outputs aligned DNA sequences, contains a flaw where data may be prematurely discarded from memory. This can lead to attempts to read from freed memory, potentially leaking program state or causing a crash. The issue occurs due to incorrect memory management within the mpileup command.

Recommendations Update to SAMtools version 1.21.1 or later. Update to SAMtools version 1.22 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31972

GHSA-72C8-4JF3-F27P

Affected Products

Samtools

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31972.json · Exploit
• https://github.com/samtools/samtools/security/advisories/GHSA-72c8-4jf3-f27p · Vendor Advisory
• https://github.com/samtools/samtools/commit/3036eb9af945fcef359427a2d359855553da4adf · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31972 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31972 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31972 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31972 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31972 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31972 · Vendor Advisory
• https://twitter.com/CVEnew/status/2034520429683945576 · Twitter Post
• https://twitter.com/oss_security/status/2034422583328715001 · Twitter Post
• http://openwall.com/lists/oss-security/2026/03/18/11 · Note