CVE-2026-31966

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31966", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:40:10.484Z", "datePublished": "2026-03-18T18:58:47.090Z", "dateUpdated": "2026-03-18T19:58:26.525Z"}, "containers": {"cna": {"title": "HTSlib CRAM reader has out-of-bounds read due to improper validation of input", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3"}, {"name": "https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28", "tags": ["x_refsource_MISC"], "url": "https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28"}, {"name": "https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3", "tags": ["x_refsource_MISC"], "url": "https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3"}, {"name": "https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4", "tags": ["x_refsource_MISC"], "url": "https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4"}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"version": "< 1.21.1", "status": "affected"}, {"version": ">= 1.22, < 1.22.2", "status": "affected"}, {"version": "= 1.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T18:58:47.090Z"}, "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the `cram_decode_seq()` function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM `MD` tag. This allowed arbitrary data to be leaked to the calling function. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "source": {"advisory": "GHSA-5cj8-mj52-8vp3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T19:58:01.811957Z", "id": "CVE-2026-31966", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T19:58:26.525Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T19:58:01.811957Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T19:58:22.331Z"}}], "cna": {"title": "HTSlib CRAM reader has out-of-bounds read due to improper validation of input", "source": {"advisory": "GHSA-5cj8-mj52-8vp3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "references": [{"url": "https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3", "name": "https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28", "name": "https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3", "name": "https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4", "name": "https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the `cram_decode_seq()` function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM `MD` tag. This allowed arbitrary data to be leaked to the calling function. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T18:58:47.090Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31966", "state": "PUBLISHED", "dateUpdated": "2026-03-18T19:58:26.525Z", "dateReserved": "2026-03-10T15:40:10.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T18:58:47.090Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "htslib", "vendor": "samtools", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "A069D6B6-FFF6-4DB7-9811-A568ECC4B288", "versionEndExcluding": "1.21.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9D525C8-C8AD-4368-A396-EB4D9DA02B1C", "versionEndExcluding": "1.22.2", "versionStartIncluding": "1.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*", "matchCriteriaId": "AAA6BBB2-76F3-4372-9BAE-FDE157401EFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of \"features\". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the `cram_decode_seq()` function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM `MD` tag. This allowed arbitrary data to be leaked to the calling function. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}, {"lang": "es", "value": "HTSlib es una biblioteca para leer y escribir formatos de archivo de bioinform\u00e1tica. CRAM es un formato comprimido que almacena datos de alineaci\u00f3n de secuencias de ADN. Como un m\u00e9todo para eliminar datos redundantes, CRAM utiliza compresi\u00f3n basada en referencia de modo que, en lugar de almacenar la secuencia completa para cada registro de alineaci\u00f3n, almacena una ubicaci\u00f3n en una secuencia de referencia externa junto con una lista de diferencias con la referencia en esa ubicaci\u00f3n como una secuencia de 'caracter\u00edsticas'. Al decodificar registros CRAM, los datos de referencia se almacenan en un array de caracteres, y las partes que coinciden con la secuencia del registro de alineaci\u00f3n se copian seg\u00fan sea necesario. Debido a una validaci\u00f3n insuficiente de la serie de datos de caracter\u00edsticas, fue posible hacer que la funci\u00f3n `cram_decode_seq()` copiara datos desde antes del inicio o despu\u00e9s del final de la referencia almacenada, ya sea en el b\u00fafer utilizado para almacenar la secuencia de salida para el registro cram, o en el b\u00fafer utilizado para construir la etiqueta SAM `MD`. Esto permiti\u00f3 que datos arbitrarios se filtraran a la funci\u00f3n llamante. Este error puede permitir que se filtre informaci\u00f3n sobre el estado del programa. Tambi\u00e9n puede causar un fallo del programa a trav\u00e9s de un intento de acceder a memoria no v\u00e1lida. Las versiones 1.23.1, 1.22.2 y 1.21.1 incluyen correcciones para este problema. No hay una soluci\u00f3n alternativa para este problema."}], "id": "CVE-2026-31966", "lastModified": "2026-06-17T10:34:51.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31966", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T19:58:01.811957Z", "version": "2.0.3"}}]}, "published": "2026-03-18T20:16:21.060", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/samtools/htslib/commit/2a45eb129d703ad27f9fabc8169f0e94d3c69fa3"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/samtools/htslib/commit/4a5ef25eb1fb3d64438103316fffe423b2c3f5f4"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-129"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.21.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22,1.22.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.23"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "htslib", "vendor": "samtools"}], "analysis": {"en": {"generated_at": "2026-03-19T15:30:23.478784+00:00", "value": {"mitigation_remediation": ["Upgrade htslib to a patched version (\u22651.23.1, which includes the resolution for CVE-2026-31966)."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Product: HTSlib (samtools:htslib). Affected releases include 1.23.1, 1.22.2, and 1.21.1. All CPEs listed in the public data refer to these releases. Users running any of these specific versions are impacted and must update to a patched version.", "description_and_impact": "HTSlib\u2019s CRAM decoding routine, specifically the cram_decode_seq() function, incorrectly validates the sequence of features that describe differences relative to an external reference. The routine copies portions of the reference into output buffers without properly checking boundaries, causing out\u2011of\u2011bounds reads into memory preceding or following the reference data. This flaw allows a malicious or malformed CRAM file to leak arbitrary data from process memory into the returned sequence or the SAM MD tag, or to trigger a crash via invalid memory access. The vulnerability aligns with CWE\u2011125 (Out\u2011of\u2011Bounds Read) and CWE\u2011129 (Improper Validation of Array Index).", "risk_and_exploitability": "The CVSS score is 6.9, indicating moderate severity. EPSS is reported as less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local or remote if an attacker can supply a crafted CRAM file to an application using HTSlib. Exploitation requires no special privileges beyond the normal execution context of the application."}}}}, "created": "2026-03-19T08:55:41.869965+00:00", "updated": "2026-03-25T11:52:24.473318+00:00", "vendors": ["samtools", "samtools$PRODUCT$htslib"]}