CVE-2026-31973

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31973", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:40:10.486Z", "datePublished": "2026-03-18T20:34:00.846Z", "dateUpdated": "2026-03-19T16:14:59.386Z"}, "containers": {"cna": {"title": "NULL pointer dereference in samtools cram-size", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43"}, {"name": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f", "tags": ["x_refsource_MISC"], "url": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f"}], "affected": [{"vendor": "samtools", "product": "samtools", "versions": [{"version": ">= 1.17, < 1.21.1", "status": "affected"}, {"version": ">= 1.22, < 1.22.2", "status": "affected"}, {"version": "= 1.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T20:34:00.846Z"}, "descriptions": [{"lang": "en", "value": "SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "source": {"advisory": "GHSA-x86f-q6fj-cm43", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/18/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-18T23:08:20.721Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T16:14:49.923184Z", "id": "CVE-2026-31973", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T16:14:59.386Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/18/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-18T23:08:20.721Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-19T16:14:49.923184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T16:14:55.472Z"}}], "cna": {"title": "NULL pointer dereference in samtools cram-size", "source": {"advisory": "GHSA-x86f-q6fj-cm43", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "samtools", "product": "samtools", "versions": [{"status": "affected", "version": ">= 1.17, < 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "references": [{"url": "https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43", "name": "https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f", "name": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T20:34:00.846Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31973", "state": "PUBLISHED", "dateUpdated": "2026-03-19T16:14:59.386Z", "dateReserved": "2026-03-10T15:40:10.486Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T20:34:00.846Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "samtools", "vendor": "samtools", "versions": [{"status": "affected", "version": ">= 1.17, < 1.21.1"}, {"status": "affected", "version": ">= 1.22, < 1.22.2"}, {"status": "affected", "version": "= 1.23"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samtools:samtools:*:*:*:*:*:*:*:*", "matchCriteriaId": "2AAB5401-9187-4F27-A463-B52558DE6D9D", "versionEndIncluding": "1.21.1", "versionStartIncluding": "1.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:samtools:samtools:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD12CAC6-5A57-435F-991C-FFA0DB2F3400", "versionEndExcluding": "1.22.2", "versionStartIncluding": "1.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:samtools:samtools:1.23:*:*:*:*:*:*:*", "matchCriteriaId": "7FAB480A-76D2-4850-B9D0-4D7F9C32B8C4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}, {"lang": "es", "value": "SAMtools es un programa para leer, manipular y escribir formatos de archivo bioinform\u00e1ticos. A partir de la versi\u00f3n 1.17, en el comando cram-size, utilizado para escribir informaci\u00f3n sobre qu\u00e9 tan bien se comprimen los archivos CRAM, se omiti\u00f3 una comprobaci\u00f3n para ver si 'cram_decode_compression_header()' estaba ausente. Si la funci\u00f3n devolv\u00eda un error, esto podr\u00eda llevar a una desreferenciaci\u00f3n de puntero NULL. Explotar este error causa una desreferenciaci\u00f3n de puntero NULL. T\u00edpicamente, esto har\u00e1 que el programa falle. Las versiones 1.23.1, 1.22.2 y 1.21.1 incluyen correcciones para este problema. No hay una soluci\u00f3n alternativa para este problema."}], "id": "CVE-2026-31973", "lastModified": "2026-06-17T10:34:52.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31973", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T16:14:49.923184Z", "version": "2.0.3"}}]}, "published": "2026-03-18T21:16:26.250", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/18/12"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.17,1.21.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.22,1.22.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.23"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "samtools", "vendor": "samtools"}], "analysis": {"en": {"generated_at": "2026-03-19T20:51:16.086088+00:00", "value": {"mitigation_remediation": ["Upgrade to samtools version 1.23.1, 1.22.2, or 1.21.1, which include the fix."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service (Application Crash)"}, "threat_synthesis": {"affected_systems": "Affected product: samtools:samtools. Versions from 1.17 up to, but not including, the patched releases 1.21.1, 1.22.2, and 1.23.1 are vulnerable. The patch is included in releases 1.21.1, 1.22.2, and 1.23.1; any installation older than 1.21.1 is at risk.", "description_and_impact": "The flaw exists in the cram-size command of SAMtools starting from version 1.17, where a missing check on the return value of cram_decode_compression_header() can lead to a NULL pointer dereference. The resulting crash causes the program to terminate, disrupting any bioinformatics pipeline that relies on SAMtools. This is a policy\u2011flaw type of memory error (CWE\u2011476).", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability requires an attacker to invoke cram-size with a CRAM header that causes cram_decode_compression_header() to fail, which would likely need local or restricted input access. Once triggered, the application crashes, providing a denial\u2011of\u2011service to legitimate users but not affecting confidentiality or integrity of other systems."}}}}, "created": "2026-03-19T08:55:33.554940+00:00", "updated": "2026-03-25T11:52:15.948098+00:00", "vendors": ["samtools", "samtools$PRODUCT$samtools"]}