CVE-2026-31969 - Vulnerability Analysis

Overview

HTSlib contains a heap buffer overflow caused by an out-of-one error in the cram_byte_array_stop_decode_char() function when reading BYTE_ARRAY_STOP encoded data, letting attackers cause crashes or arbitrary code execution, exploit requires opening a crafted file.

Severity & Score

Impact

Attackers can cause crashes, data corruption, or potentially execute arbitrary code by opening a crafted file.

Mitigation

Update to versions 1.23.1, 1.22.2, 1.21.1 or later.

References

• https://github.com/samtools/htslib/commit/88cdf69e4b83bb550ab4f6f7134892c2ad1978f4
• https://github.com/samtools/htslib/security/advisories/GHSA-q4cj-f4h5-fqgc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner