CVE-2026-31963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31963", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:40:10.484Z", "datePublished": "2026-03-18T18:22:58.440Z", "dateUpdated": "2026-03-18T18:52:43.260Z"}, "containers": {"cna": {"title": "HTSlib CRAM reader has heap buffer overflow due to improper validation of input", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c"}, {"name": "https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd", "tags": ["x_refsource_MISC"], "url": "https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd"}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"version": "< 1.21.1", "status": "affected"}, {"version": ">= 1.22, < 1.22.2", "status": "affected"}, {"version": "= 1.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T18:22:58.440Z"}, "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "source": {"advisory": "GHSA-qgqh-h2q9-7w3c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T18:52:31.355632Z", "id": "CVE-2026-31963", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T18:52:43.260Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31963", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T18:52:31.355632Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T18:52:37.229Z"}}], "cna": {"title": "HTSlib CRAM reader has heap buffer overflow due to improper validation of input", "source": {"advisory": "GHSA-qgqh-h2q9-7w3c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "references": [{"url": "https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c", "name": "https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd", "name": "https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T18:22:58.440Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31963", "state": "PUBLISHED", "dateUpdated": "2026-03-18T18:52:43.260Z", "dateReserved": "2026-03-10T15:40:10.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T18:22:58.440Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "htslib", "vendor": "samtools", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "A069D6B6-FFF6-4DB7-9811-A568ECC4B288", "versionEndExcluding": "1.21.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9D525C8-C8AD-4368-A396-EB4D9DA02B1C", "versionEndExcluding": "1.22.2", "versionStartIncluding": "1.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*", "matchCriteriaId": "AAA6BBB2-76F3-4372-9BAE-FDE157401EFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}, {"lang": "es", "value": "HTSlib es una biblioteca para leer y escribir formatos de archivo de bioinform\u00e1tica. CRAM es un formato comprimido que almacena datos de alineaci\u00f3n de secuencias de ADN. Como un m\u00e9todo para eliminar datos redundantes, CRAM utiliza compresi\u00f3n basada en referencias de modo que, en lugar de almacenar la secuencia completa para cada registro de alineaci\u00f3n, almacena una ubicaci\u00f3n en una secuencia de referencia externa junto con una lista de diferencias con la referencia en esa ubicaci\u00f3n como una secuencia de 'features'. Al decodificar estas 'features', un error por uno en una prueba para 'features' de CRAM que aparecen m\u00e1s all\u00e1 del alcance de la secuencia de registro de CRAM podr\u00eda resultar en una escritura inv\u00e1lida de un byte controlado por el atacante m\u00e1s all\u00e1 del final de un b\u00fafer de pila. Explotar este error causa un desbordamiento de b\u00fafer de pila. Si un usuario abre un archivo dise\u00f1ado para explotar este problema, podr\u00eda provocar el bloqueo del programa o la sobrescritura de datos y estructuras de pila de formas no esperadas por el programa. Podr\u00eda ser posible usar esto para obtener ejecuci\u00f3n de c\u00f3digo arbitrario. Las versiones 1.23.1, 1.22.2 y 1.21.1 incluyen correcciones para este problema. No hay soluci\u00f3n alternativa para este problema."}], "id": "CVE-2026-31963", "lastModified": "2026-06-17T10:34:51.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31963", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T18:52:31.355632Z", "version": "2.0.3"}}]}, "published": "2026-03-18T19:16:04.440", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-129"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "htslib: HTSlib: Arbitrary code execution via crafted CRAM file", "id": "2448755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448755"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-193", "details": ["A flaw was found in HTSlib, a library for reading and writing bioinformatics file formats. When processing CRAM (Compressed Reference-oriented Alignment Map) files, an out-by-one error in feature decoding can cause a heap buffer overflow. This vulnerability allows an attacker to craft a malicious CRAM file which, when opened by a user, could lead to a program crash, data corruption, or potentially arbitrary code execution."], "name": "CVE-2026-31963", "public_date": "2026-03-18T18:22:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31963\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31963\nhttps://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd\nhttps://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c"], "statement": "This is an IMPORTANT flaw due to a heap buffer overflow in the HTSlib CRAM reader when processing specially crafted CRAM files. This flaw requires user interaction, as it is triggered when an application linked against HTSlib opens a malicious CRAM file, potentially leading to arbitrary code execution or data corruption.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.21.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22,1.22.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.23,1.23]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "htslib", "vendor": "samtools"}], "analysis": {"en": {"generated_at": "2026-03-19T16:51:56.875579+00:00", "value": {"mitigation_remediation": ["Upgrade htslib to version 1.23.1 or later."], "summary": {"action": "Patch ASAP", "impact": "Heap Buffer Overflow leading to possible code execution"}, "threat_synthesis": {"affected_systems": "The flaw is present in the htslib component of the samtools project, which is used by a wide range of bioinformatics tools to read and write compressed alignment files. Versions of htslib released prior to the security patch \u2013 i.e., any release older than 1.21.1, 1.22.2, or 1.23.1 \u2013 are affected. All builds newer than those \u2013 such as 1.23.1 and subsequent releases \u2013 contain the fix. Systems that process CRAM files with an unpatched htslib instance are therefore at risk.", "description_and_impact": "HTSlib, a C library for handling bioinformatics file formats, includes a CRAM reader that reconstructs aligned reads from compressed data. During decoding, the implementation checks for CRAM features that exceed the extent of the record sequence. An out\u2011by\u2011one error in this boundary test allows a crafted feature to write a single attacker\u2011controlled byte just past the end of a heap\u2011allocated buffer. This heap buffer overflow can corrupt adjacent memory, potentially resulting in program crash, data corruption, or, in the most severe cases, arbitrary code execution. The vulnerability is represented by several standard weaknesses: buffer overread (CWE\u2011122), off\u2011by\u2011one error (CWE\u2011129), signed/unsigned mismatch (CWE\u2011193), and heap buffer overflow (CWE\u2011787).", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The issue is not listed in CISA\u2019s KEV catalog, reinforcing that it has not yet been widely exploited. Exploitation requires an attacker to supply a malicious CRAM file that an application will decode. The attack vector is therefore file\u2011based, usually local if the file is opened manually, or remote if an application receives CRAM data from an untrusted source such as a network service. Because the flaw corrupts heap rather than allowing unrestricted memory read/write, the ultimate impact depends on the target application; the most damaging outcome is presumed to be code execution that could grant an attacker persistence or privilege escalation. Consequently, applying the vendor\u2011provided patch as soon as possible is the recommended mitigative action."}}}}, "created": "2026-03-19T08:55:44.572668+00:00", "updated": "2026-03-25T11:52:27.314129+00:00", "vendors": ["samtools", "samtools$PRODUCT$htslib"]}