CVE-2026-31970

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31970", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:40:10.485Z", "datePublished": "2026-03-18T19:53:18.719Z", "dateUpdated": "2026-03-18T23:08:18.668Z"}, "containers": {"cna": {"title": "HTSlib BGZF index file reader has a heap buffer overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-131", "lang": "en", "description": "CWE-131: Incorrect Calculation of Buffer Size", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1284", "lang": "en", "description": "CWE-1284: Improper Validation of Specified Quantity in Input", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q"}, {"name": "https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828", "tags": ["x_refsource_MISC"], "url": "https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828"}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"version": "< 1.21.1", "status": "affected"}, {"version": ">= 1.22, < 1.22.2", "status": "affected"}, {"version": "= 1.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T19:53:18.719Z"}, "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. The easiest work-around is to discard any `.gzi` index files from untrusted sources, and use the `bgzip -r` option to recreate them."}], "source": {"advisory": "GHSA-p345-84hx-fq6q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T20:14:03.491471Z", "id": "CVE-2026-31970", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T20:14:13.390Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/18/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-18T23:08:18.668Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/18/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-18T23:08:18.668Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31970", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T20:14:03.491471Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T20:14:06.402Z"}}], "cna": {"title": "HTSlib BGZF index file reader has a heap buffer overflow", "source": {"advisory": "GHSA-p345-84hx-fq6q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "samtools", "product": "htslib", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "references": [{"url": "https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q", "name": "https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828", "name": "https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. The easiest work-around is to discard any `.gzi` index files from untrusted sources, and use the `bgzip -r` option to recreate them."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-131", "description": "CWE-131: Incorrect Calculation of Buffer Size"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284: Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T19:53:18.719Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31970", "state": "PUBLISHED", "dateUpdated": "2026-03-18T23:08:18.668Z", "dateReserved": "2026-03-10T15:40:10.485Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T19:53:18.719Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "htslib", "vendor": "samtools", "versions": [{"status": "affected", "version": "< 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "CABE63DE-3B1C-4D14-9318-AB2A94625586", "versionEndExcluding": "1.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9D525C8-C8AD-4368-A396-EB4D9DA02B1C", "versionEndExcluding": "1.22.2", "versionStartIncluding": "1.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*", "matchCriteriaId": "AAA6BBB2-76F3-4372-9BAE-FDE157401EFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. The easiest work-around is to discard any `.gzi` index files from untrusted sources, and use the `bgzip -r` option to recreate them."}, {"lang": "es", "value": "HTSlib es una biblioteca para leer y escribir formatos de archivo de bioinform\u00e1tica. Los archivos GZI se utilizan para indexar archivos GZIP [BGZF] comprimidos por bloques. En la funci\u00f3n de carga GZI, `bgzf_index_load_hfile()`, fue posible activar un desbordamiento de entero, lo que llev\u00f3 a la asignaci\u00f3n de un b\u00fafer de tama\u00f1o insuficiente o cero para almacenar el \u00edndice. Luego se escribir\u00edan diecis\u00e9is bytes cero en este b\u00fafer y, dependiendo del resultado del desbordamiento, el resto del archivo tambi\u00e9n podr\u00eda cargarse en el b\u00fafer. Si la funci\u00f3n intentaba cargar los datos, eventualmente fallar\u00eda debido a que no le\u00eda el n\u00famero esperado de registros, y luego intentar\u00eda liberar el b\u00fafer de pila desbordado. Explotar este error causa un desbordamiento de b\u00fafer de pila. Si un usuario abre un archivo dise\u00f1ado para explotar este problema, podr\u00eda provocar el bloqueo del programa o la sobrescritura de datos y estructuras de pila de formas no esperadas por el programa. Puede ser posible usar esto para obtener ejecuci\u00f3n de c\u00f3digo arbitrario. Las versiones 1.23.1, 1.22.2 y 1.21.1 incluyen correcciones para este problema. La soluci\u00f3n alternativa m\u00e1s sencilla es descartar cualquier archivo de \u00edndice `.gzi` de fuentes no confiables y usar la opci\u00f3n `bgzip -r` para recrearlos."}], "id": "CVE-2026-31970", "lastModified": "2026-06-17T10:34:51.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31970", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T20:14:03.491471Z", "version": "2.0.3"}}]}, "published": "2026-03-18T20:16:21.980", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/18/9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-131"}, {"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}, {"lang": "en", "value": "CWE-1284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.21.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22,1.22.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.23"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "htslib", "vendor": "samtools"}], "analysis": {"en": {"generated_at": "2026-03-19T15:57:00.986902+00:00", "value": {"mitigation_remediation": ["Upgrade htslib to version 1.23.1 or later (or to 1.22.2 / 1.21.1 if those are the latest maintained releases).", "If an upgrade is not immediately possible, remove any .gzi index files from untrusted sources and generate new indexes with the bgzip -r option."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the htslib component of samtools. Versions prior to 1.21.1, 1.22.2 and 1.23.1 are vulnerable. The CPE entries include htslib:htslib 1.23 and any earlier releases. Users running older releases of htslib should verify their version.", "description_and_impact": "HTSlib\u2019s BGZF index file reader contains a heap buffer overflow triggered by an integer overflow in the bgzf_index_load_hfile() function. A crafted .gzi file can cause an under\u2011or zero\u2011sized buffer allocation, leading to 16 arbitrary bytes being written and, depending on the overflow, the remainder of the file being loaded. The overflow ultimately causes a crash or corruption of heap structures, potentially allowing arbitrary code execution. This weakness is associated with several known CVEs including CWE\u2011122, CWE\u20111284, CWE\u2011131, CWE\u2011190, and CWE\u2011787.", "risk_and_exploitability": "The CVSS score for this issue is 7.1, indicating a high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower probability of widespread exploitation. Attackers would need to supply a malicious .gzi index file to an application that uses HTSlib; thus the vector is local file input. If an attacker can supply such a file, the resulting heap buffer overflow could allow code execution or denial of service."}}}}, "created": "2026-03-19T08:55:37.683633+00:00", "updated": "2026-03-25T11:52:19.684241+00:00", "vendors": ["samtools", "samtools$PRODUCT$htslib"]}