What is the CVSS score of CVE-2026-31967?

CVE-2026-31967 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Htslib are affected by CVE-2026-31967?

Organizations using HTSlib should be aware of notable risk from CVE-2026-31967, a out-of-bounds read vulnerability rated CVSS 6.9. Exploitation could cause memory corruption or application crashes.. A patch is available.

How to fix or mitigate CVE-2026-31967?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Htslib CVE-2026-31967

EUVD-2026-12938 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-18 GitHub_M

Denial Of Service Debian Htslib

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 19:30 euvd

EUVD-2026-12938

Analysis Generated

Mar 18, 2026 - 19:30 vuln.today

CVE Published

Mar 18, 2026 - 19:15 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cram_decode_slice() function called while reading CRAM records, the value of the mate reference id field was not validated. Later use of this value, for example when converting the data to SAM format, could result in the out of bounds array reads when looking up the corresponding reference name. If the array value obtained also happened to be a valid pointer, it would be interpreted as a string and an attempt would be made to write the data as part of the SAM record. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

AnalysisAI

HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain an out-of-bounds read vulnerability in the CRAM file parser where the mate reference ID field is not validated during decoding. An attacker can craft a malicious CRAM file that, when processed by affected applications (particularly those converting CRAM to SAM format), triggers out-of-bounds array access that may leak sensitive information about program state or cause a denial of service through memory access violations. No public exploit has been reported, but no workaround exists, making patching essential.

Technical ContextAI

HTSlib (cpe:2.3:a:samtools:htslib:*:*:*:*:*:*:*:*) is a widely-used C library for reading and writing bioinformatics file formats including CRAM (Compression of Alignment Mapping). The vulnerability exists in the cram_decode_slice() function, which parses CRAM compressed DNA sequence alignment data. The root cause is classified as CWE-125 (Out-of-bounds Read) where the mate reference ID field—an index into a reference sequence array—is not bounds-checked before use. Later operations such as SAM format conversion use this unchecked index to look up reference names, resulting in arbitrary array access. If the out-of-bounds memory location contains a valid pointer, it may be interpreted as a string and written into SAM output, creating an information disclosure channel.

RemediationAI

Immediately upgrade HTSlib to version 1.23.1, 1.22.2, or 1.21.1 or later, depending on your deployed version branch (see https://github.com/samtools/htslib/security/advisories/GHSA-33x5-c6vj-8f2w for version mapping). Patch is available in commit 9cefb46453ad471e933b8212d4f45920524d3357. No workaround exists, so patching is mandatory. For organizations unable to upgrade immediately, restrict processing of CRAM files to trusted, validated sources and implement input validation at the application layer if feasible. Verify that all dependent tools (samtools, variant callers, alignment tools) are rebuilt against the patched HTSlib version.