https://seclists.org/oss-sec/2026/q1/342: HTSlib <= 1.23 Multiple vulnerabilities in the CRAM file ader
Published Mar 18, 2026
·Updated
Affected Software
3 affected components
HTSlib<1.23
HTSlib>=1.21.1<=1.22.2
HTSlib
Frequently Asked Questions
1
Which releases contain fixes?
The vulnerabilities are fixed in HTSlib 1.23.1. Fixes have also been back-ported to versions 1.22.2 and 1.21.1.
2
What does an attacker need to exploit the heap overflow?
An attacker needs a user or application to open a crafted CRAM file. The vulnerable CRAM reader can then read one byte beyond a heap allocation and write an attacker-controlled byte at that location.
3
Who is exposed to this issue?
Systems using affected HTSlib versions to read CRAM alignment files are exposed when they process attacker-crafted CRAM input. The issue is in the CRAM reader's handling of records that omit sequence and quality data.