What is the CVSS score of CVE-2026-31966?

CVE-2026-31966 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Htslib are affected by CVE-2026-31966?

Organizations using HTSlib should be aware of notable risk from CVE-2026-31966, a out-of-bounds read vulnerability rated CVSS 6.9. Exploitation could cause memory corruption or application crashes.. A patch is available.

How to fix or mitigate CVE-2026-31966?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Htslib CVE-2026-31966

EUVD-2026-12936 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-18 GitHub_M

Buffer Overflow Information Disclosure Denial Of Service Debian Htslib

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 19:30 euvd

EUVD-2026-12936

Analysis Generated

Mar 18, 2026 - 19:30 vuln.today

CVE Published

Mar 18, 2026 - 18:58 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it stores a location in an external reference sequence along with a list of differences to the reference at that location as a sequence of "features". When decoding CRAM records, the reference data is stored in a char array, and parts matching the alignment record sequence are copied over as necessary. Due to insufficient validation of the feature data series, it was possible to make the cram_decode_seq() function copy data from either before the start, or after the end of the stored reference either into the buffer used to store the output sequence for the cram record, or into the buffer used to build the SAM MD tag. This allowed arbitrary data to be leaked to the calling function. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

AnalysisAI

HTSlib versions prior to 1.21.1, 1.22.2, and 1.23.1 contain a buffer over-read vulnerability in the CRAM decoder's cram_decode_seq() function that fails to properly validate feature data offsets. An attacker can craft malicious CRAM files to read arbitrary data from memory adjacent to reference sequence buffers, leading to information disclosure of program state or denial of service through memory access violations. No active exploitation has been documented, but patches are available from the vendor.

Technical ContextAI

HTSlib is a C library (CPE: cpe:2.3:a:samtools:htslib) used across bioinformatics workflows for reading and writing sequence alignment file formats including CRAM. CRAM achieves compression through reference-based encoding: instead of storing full DNA sequences, it stores reference coordinates and a series of 'features' that describe differences from the reference. During decoding, the cram_decode_seq() function copies reference data into output buffers based on feature offsets. The root cause is classified as CWE-125 (Out-of-bounds Read), stemming from insufficient validation of feature data boundaries before memory copy operations. This allows reads from memory locations before the start or after the end of the reference buffer, which can be written into either the sequence output buffer or the MD tag construction buffer.

RemediationAI

Upgrade HTSlib to version 1.23.1 or later (preferred), or to 1.22.2 if remaining on the 1.22.x line, or to 1.21.1 if constrained to the 1.21.x line. Consult https://github.com/samtools/htslib/security/advisories/GHSA-5cj8-mj52-8vp3 for patch details and https://github.com/samtools/htslib/commit/22ec5230ef95769ab009420da69568c7e530af28 and related commits for code changes. There is no documented workaround; patching is mandatory. In environments where rapid patching is infeasible, implement input validation by rejecting CRAM files from untrusted sources and consider using alternative formats pending patch deployment.