CVE-2026-31966 - Vulnerability Analysis

Overview

HTSlib contains an information disclosure caused by insufficient validation in cram_decode_seq() function when decoding CRAM records, letting attackers leak arbitrary data from memory, exploit requires crafted CRAM data.

Severity & Score

Impact

Attackers can leak arbitrary memory data, potentially exposing sensitive information or causing program crashes.

Mitigation

Update to version 1.23.1, 1.22.2, 1.21.1 or later.

References

• https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28
• https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3
• https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4
• https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 19, 2026

🔴 CVE-2026-31966 - Critical (9.1) HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of stori... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31966/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner