CVE-2026-31970 - Vulnerability Analysis

Overview

HTSlib contains a heap buffer overflow caused by an integer overflow in the bgzf_index_load_hfile() function when loading GZI files, letting attackers cause crashes or potentially execute arbitrary code, exploit requires opening a crafted file.

Severity & Score

Impact

Attackers can cause program crashes or potentially execute arbitrary code by opening crafted GZI files.

Mitigation

Update to versions 1.23.1, 1.22.2, 1.21.1 or later. Discard untrusted .gzi files and recreate using bgzip -r.

References

• https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828
• https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q
• http://www.openwall.com/lists/oss-security/2026/03/18/9

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 19, 2026

🟠 CVE-2026-31970 - High (8.1) HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leadi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31970/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner