CVE-2026-116742: HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzfindexloadhfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzfuseek(), resulting in heap corruption or crashes in tools like samtools and bcftools.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Systems using HTSlib through 1.24 are exposed when they load a crafted .gzi index file. Tools identified as affected in the available data include samtools and bcftools.
What must an attacker provide or cause a user to do?
An attacker needs to supply a crafted .gzi index whose entry count is 0xFFFFFFFF and have it processed by vulnerable HTSlib code. The supplied vector indicates local access and user interaction are required.
How can I identify suspicious input associated with this vulnerability?
Inspect .gzi index files that are processed by affected software for an entry count of 0xFFFFFFFF. Processing such a file may result in heap corruption or application crashes.