Multiple vulnerabilities, listed below, have been disclosed in the HTSlib CRAM file reader. These have all been fixed in version 1.23.1, and fixes have also been back-ported to versions 1.22.2 and 1.21.1
CVE-2026-31962 Severity: High =============================
Heap buffer overflow in HTSlib CRAM reader due to improper validation of input
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the cramdecodeseq() did not handle this correctly in some cases. Where this happened it could result in reading a single byte from beyond the end of a heap allocation, followed by writing a single attacker-controlled byte to the same location.
Impact ------
Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution.
Severity --------
High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-xxmp-v7h3-gpwp https://www.cve.org/CVERecord?id=CVE-2026-31962
CVE-2026-31963 Severity: High =============================
Heap buffer overflow in HTSlib CRAM reader due to improper validation of input
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyond the end of a heap buffer.
Impact ------
Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution.
Severity --------
High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-qgqh-h2q9-7w3c https://www.cve.org/CVERecord?id=CVE-2026-31963
CVE-2026-31968 Severity: High =============================
Buffer overflow vulnerabilities in HTSlib CRAM decoder
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. For the VARINT and CONST encodings, incomplete validation of the context in which the encodings were used could result in up to eight bytes being written beyond the end of a heap allocation, or up to eight bytes being written to the location of a one byte variable on the stack, possibly causing the values to adjacent variables to change unexpectedly.
Impact ------
Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a user opens a file crafted to exploit this issue it could lead to the program crashing, overwriting of data structures on the heap or stack in ways not expected by the program, or changing the control flow of the program. It may be possible to use this to obtain arbitrary code execution.
Severity --------
High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-cgcm-c9r2-p57j https://www.cve.org/CVERecord?id=CVE-2026-31968
CVE-2026-31969 Severity: High =============================
Heap buffer overflow in HTSlib CRAM decoder
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTEARRAYSTOP method, an out-by-one error in the crambytearraystopdecodechar() function check for a full output buffer could result in a single attacker-controlled byte being written beyond the end of a heap allocation.
Impact ------
Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution.
Severity --------
High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-q4cj-f4h5-fqgc https://www.cve.org/CVERecord?id=CVE-2026-31969
CVE-2026-31971 Severity: High =============================
Buffer overflow vulnerabilities in HTSlib CRAM decoder
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTEARRAYLEN method, the crambytearraylendecode() failed to validate that the amount of data being unpacked matched the size of the output buffer where it was to be stored. Depending on the data series being read, this could result either in a heap or a stack overflow with attacker-controlled bytes.
Impact ------
Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a user opens a file crafted to exploit this issue it could lead to the program crashing, overwriting of data structures on the heap or stack in ways not expected by the program, or changing the control flow of the program. It may be possible to use this to obtain arbitrary code execution.
Severity --------
High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-jvx4-4wq7-6fmh https://www.cve.org/CVERecord?id=CVE-2026-31971
CVE-2026-31964 Severity: Moderate =================================
NULL Pointer Dereference in HTSlib CRAM decoder
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the CONST, XPACK and XRLE encodings did not properly implement the interface needed to do this. Trying to decode records with omitted sequence or quality data using these encodings would result in an attempt to write to a NULL pointer.
Impact ------
Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash.
Severity --------
Moderate CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-5w97-85gf-86rm https://www.cve.org/CVERecord?id=CVE-2026-31964
CVE-2026-31965 Severity: Moderate =================================
Out-of-bounds reads in HTSlib CRAM reader due to improper validation of input
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cramdecodeslice() function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected.
Impact ------
The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory.
Severity --------
Moderate CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr https://www.cve.org/CVERecord?id=CVE-2026-31965
CVE-2026-31966 Severity: Moderate =================================
Out-of-bounds read in HTSlib CRAM reader due to improper validation of input
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the cramdecodeseq() function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM MD tag. This allowed arbitrary data to be leaked to the calling function.
Impact ------
This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory.
Severity --------
Moderate CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3 https://www.cve.org/CVERecord?id=CVE-2026-31966
CVE-2026-31967 Severity: Moderate =================================
Out-of-bounds read in HTSlib CRAM reader due to improper validation of input
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cramdecodeslice() function called while reading CRAM records, the value of the mate reference id field was not validated. Later use of this value, for example when converting the data to SAM format, could result in the out of bounds array reads when looking up the corresponding reference name. If the array value obtained also happened to be a valid pointer, it would be interpreted as a string and an attempt would be made to write the data as part of the SAM record.
Impact ------
This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory.
Severity --------
Moderate CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
There is no workaround for this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-33x5-c6vj-8f2w https://www.cve.org/CVERecord?id=CVE-2026-31967
--
The SAMtools team https://www.htslib.org/ https://www.sanger.ac.uk/
---------------------------------------------------------------------- The Wellcome Sanger Institute is operated by Genome Research Limited, a charity registered in England with number 1021457 and a company registered in England with number 2742969, whose registered office is Wellcome Sanger Institute, Wellcome Genome Campus, Hinxton, CB10 1SA.
Description -----------
HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP (BGZF) files. In the GZI loading function, bgzfindexloadhfile(), it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer.
Impact ------
Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution.
Severity --------
High CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Patches -------
Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue.
Workarounds -----------
The easiest work-around is to discard any .gzi index files from untrusted sources, and use the bgzip -r option to recreate them.
Credits -------
Thanks to Harrison Green for reporting this issue.
References ----------
https://github.com/samtools/htslib/security/advisories/GHSA-p345-84hx-fq6q https://www.cve.org/CVERecord?id=CVE-2026-31970
--
The SAMtools team https://www.htslib.org/ https://www.sanger.ac.uk/
---------------------------------------------------------------------- The Wellcome Sanger Institute is operated by Genome Research Limited, a charity registered in England with number 1021457 and a company registered in England with number 2742969, whose registered office is Wellcome Sanger Institute, Wellcome Genome Campus, Hinxton, CB10 1SA.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTEARRAYSTOP method, an out-by-one error in the crambytearraystopdecodechar() function check for a full output buffer could result in a single attacker-controlled byte being written beyond the end of a heap allocation. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. For the VARINT and CONST encodings, incomplete validation of the context in which the encodings were used could result in up to eight bytes being written beyond the end of a heap allocation, or up to eight bytes being written to the location of a one byte variable on the stack, possibly causing the values to adjacent variables to change unexpectedly. Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a user opens a file crafted to exploit this issue it could lead to the program crashing, overwriting of data structures on the heap or stack in ways not expected by the program, or changing the control flow of the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the cramdecodeseq() function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM MD tag. This allowed arbitrary data to be leaked to the calling function. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cramdecodeslice() function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected. The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding these features, an out-by-one error in a test for CRAM features that appear beyond the extent of the CRAM record sequence could result in an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the cramdecodeseq() did not handle this correctly in some cases. Where this happened it could result in reading a single byte from beyond the end of a heap allocation, followed by writing a single attacker-controlled byte to the same location. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
HTSlib through 1.10.2 allows out-of-bounds write access in vcfparseformat (called from vcfparse and vcfread).
In HTSlib 1.8, a race condition in cram/cramio.c might allow local users to overwrite arbitrary files via a symlink attack.
DISPUTED An issue has been found in HTSlib 1.8. It is a memory leak in bgzfgetline in bgzf.c. NOTE: the software maintainer's position is that the "failure to free memory" can be fixed in applications that use the HTSlib library (such as test/testbgzf.c in the original report) and is not a library issue.
DISPUTED An issue has been found in HTSlib 1.8. It is a memory leak in fairead in faidx.c. NOTE: This has been disputed with the assertion that this vulnerability exists in the test harness and HTSlib users would be aware of the need to destruct this object returned by faiload() in their own code.
An issue has been found in HTSlib 1.8. It is a buffer over-read in samparse1 in sam.c.
samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary code execution