What is the CVSS score of CVE-2026-31962?

CVE-2026-31962 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Which versions of Htslib are affected by CVE-2026-31962?

Organizations using HTSlib face significant risk from CVE-2026-31962, a heap-based buffer overflow vulnerability rated CVSS 8.8.. A patch is available.

How to fix or mitigate CVE-2026-31962?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Htslib CVE-2026-31962

EUVD-2026-12923 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-18 GitHub_M

Buffer Overflow Heap Overflow Denial Of Service RCE Information Disclosure Debian Htslib Red Hat

8.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat

7.3 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 18:15 euvd

EUVD-2026-12923

Analysis Generated

Mar 18, 2026 - 18:15 vuln.today

CVE Published

Mar 18, 2026 - 18:08 nvd

HIGH 8.8

DescriptionGitHub Advisory

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the cram_decode_seq() did not handle this correctly in some cases. Where this happened it could result in reading a single byte from beyond the end of a heap allocation, followed by writing a single attacker-controlled byte to the same location. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

AnalysisAI

HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain a heap buffer overflow vulnerability in the cram_decode_seq() function when processing CRAM-formatted bioinformatics files with omitted sequence and quality data. An attacker can craft a malicious CRAM file that triggers an out-of-bounds read followed by an attacker-controlled single-byte write to heap memory, potentially enabling arbitrary code execution, data corruption, or denial of service when a user opens the file. No public exploit proof-of-concept has been identified, but the vulnerability is confirmed and patched by the HTSlib project.

Technical ContextAI

HTSlib is a C library for reading and writing bioinformatics file formats including SAM, BAM, and CRAM. CRAM is a compressed sequence alignment format that optimizes storage by allowing alignment records to omit DNA sequence and quality value data in certain contexts. However, the CRAM specification requires that even omitted data be present in the file stream and must be consumed and discarded during parsing. The vulnerability exists in the cram_decode_seq() function (CWE-122: Heap-based Buffer Overflow), where improper handling of these omitted-but-present data fields causes a single-byte read beyond allocated heap bounds, followed by a write of attacker-controlled data to that same out-of-bounds location. HTSlib is widely used in genomics pipelines and research workflows (CPE: cpe:2.3:a:samtools:htslib:*:*:*:*:*:*:*:*).

RemediationAI

Immediately upgrade HTSlib to version 1.23.1, 1.22.2, or 1.21.1 depending on your active release branch (see https://github.com/samtools/htslib/security/advisories/GHSA-xxmp-v7h3-gpwp for details). The fix has been implemented in commit d799b54c6401879187bba4741be83ff590ac73e3 and addresses the incorrect data consumption logic in cram_decode_seq(). If immediate patching is not feasible, restrict file input to CRAM files from trusted, verified sources and implement file integrity validation (e.g., cryptographic signatures) at ingestion points in your bioinformatics pipeline. Avoid processing CRAM files from untrusted or internet-sourced repositories until patching is complete. No functional workaround exists that does not involve disabling CRAM format support or upgrading HTSlib.