https://seclists.org/oss-sec/2026/q1/341: CVE-2026-31970: HTSlib <= 1.23 heap buffer overflow in the BGZF index file ader

Q: What must an attacker do to trigger the vulnerability?

An attacker needs to provide a crafted BGZF index (GZI) file that is loaded when a user opens the associated file. The CVSS vector indicates no attacker privileges are required, but user interaction is required.

Q: What is the practical impact if exploitation succeeds?

The issue causes a heap buffer overflow that can crash the program or overwrite data and heap structures. The advisory states that arbitrary code execution may be possible.

Q: Which releases contain fixes?

Fixes are included in HTSlib versions 1.23.1, 1.22.2, and 1.21.1. The affected versions are stated as 1.23 and earlier.

Published Mar 18, 2026

Updated

Affected Software

1 affected component

HTSlib<=1.23

Frequently Asked Questions

What must an attacker do to trigger the vulnerability?

An attacker needs to provide a crafted BGZF index (GZI) file that is loaded when a user opens the associated file. The CVSS vector indicates no attacker privileges are required, but user interaction is required.

What is the practical impact if exploitation succeeds?

The issue causes a heap buffer overflow that can crash the program or overwrite data and heap structures. The advisory states that arbitrary code execution may be possible.

Which releases contain fixes?

Fixes are included in HTSlib versions 1.23.1, 1.22.2, and 1.21.1. The affected versions are stated as 1.23 and earlier.