What is the CVSS score of CVE-2026-31969?

CVE-2026-31969 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Which versions of Htslib are affected by CVE-2026-31969?

Organizations using HTSlib face moderate risk from CVE-2026-31969, a heap-based buffer overflow vulnerability rated CVSS 7.1.. A patch is available.

How to fix or mitigate CVE-2026-31969?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Htslib CVE-2026-31969

EUVD-2026-12944 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-18 GitHub_M

Buffer Overflow Heap Overflow Denial Of Service RCE Debian Htslib

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 20:00 euvd

EUVD-2026-12944

Analysis Generated

Mar 18, 2026 - 20:00 vuln.today

CVE Published

Mar 18, 2026 - 19:47 nvd

HIGH 7.1

DescriptionGitHub Advisory

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTE_ARRAY_STOP method, an out-by-one error in the cram_byte_array_stop_decode_char() function check for a full output buffer could result in a single attacker-controlled byte being written beyond the end of a heap allocation. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

AnalysisAI

HTSlib versions prior to 1.21.1, 1.22.2, and 1.23.1 contain an out-by-one error in the CRAM decoder's cram_byte_array_stop_decode_char() function that allows a single attacker-controlled byte to be written beyond the end of a heap allocation. This heap buffer overflow (CWE-122) affects bioinformatics applications using HTSlib to process CRAM-formatted DNA sequence alignment files, and could enable arbitrary code execution if exploited. No public exploit code or KEV status is currently documented, but patch availability exists for multiple stable release branches.

Technical ContextAI

HTSlib is a widely-used C library for reading and writing bioinformatics file formats including CRAM, BAM, and SAM. CRAM is a compressed binary format designed for efficient storage of DNA sequence alignment data, employing multiple encoding and compression schemes. The vulnerability resides in the cram_byte_array_stop_decode_char() function, which decodes data encoded using the BYTE_ARRAY_STOP compression method within CRAM streams. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), specifically an off-by-one error in the boundary check for the output buffer. The affected product is identified by CPE cpe:2.3:a:samtools:htslib:*:*:*:*:*:*:*:*, indicating all versions of HTSlib by SAMtools are affected unless patched. This library is a foundational dependency for genome analysis pipelines, variant calling suites, and bioinformatics research platforms globally.

RemediationAI

Immediately upgrade HTSlib to version 1.21.1, 1.22.2, or 1.23.1 or later, depending on your current branch. Consult the vendor advisory at https://github.com/samtools/htslib/security/advisories/GHSA-q4cj-f4h5-fqgc and review the patch commit at https://github.com/samtools/htslib/commit/88cdf69e4b83bb550ab4f6f7134892c2ad1978f4. No workaround is available according to the advisory, making patching mandatory. For organizations unable to patch immediately, implement compensating controls: validate CRAM file provenance and restrict processing to trusted sources only, run CRAM decoding operations in isolated containers or virtual machines to limit blast radius, and monitor process behavior for segmentation faults or unexpected terminations that may indicate exploitation attempts.