What is the CVSS score of CVE-2026-31970?

CVE-2026-31970 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Htslib are affected by CVE-2026-31970?

Organizations using HTSlib face moderate risk from CVE-2026-31970, a heap-based buffer overflow vulnerability rated CVSS 7.1.. A patch is available.

How to fix or mitigate CVE-2026-31970?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Htslib CVE-2026-31970

EUVD-2026-12946 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-18 GitHub_M

Buffer Overflow Heap Overflow Integer Overflow Denial Of Service RCE Debian Htslib

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 20:00 euvd

EUVD-2026-12946

Analysis Generated

Mar 18, 2026 - 20:00 vuln.today

CVE Published

Mar 18, 2026 - 19:53 nvd

HIGH 7.1

DescriptionGitHub Advisory

HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, bgzf_index_load_hfile(), it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. The easiest work-around is to discard any .gzi index files from untrusted sources, and use the bgzip -r option to recreate them.

AnalysisAI

HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain a heap buffer overflow vulnerability in the GZI index loading function bgzf_index_load_hfile(). An integer overflow during buffer allocation allows attackers to craft malicious .gzi files that trigger heap memory corruption, potentially leading to denial of service, data corruption, or remote code execution when a user opens the compromised file. No evidence of active exploitation in the wild has been reported, but the vulnerability is demonstrable and patch availability is confirmed.

Technical ContextAI

HTSlib is a widely-used C library for reading and writing bioinformatics file formats including SAM, BAM, CRAM, VCF, and BCF files. GZI files are companion index files for BGZF (block-compressed GZIP) compressed data, enabling efficient random access without decompressing entire files. The vulnerability exists in the GZI loading mechanism where an integer overflow in buffer size calculation (CWE-122: Heap-based Buffer Overflow) causes undersized or zero-length heap buffers to be allocated. The code then attempts to write 16 zero bytes followed by index records into this inadequately sized buffer, causing heap memory corruption. The affected CPE is cpe:2.3:a:samtools:htslib:*:*:*:*:*:*:*:* for versions below the patched releases.

RemediationAI

Upgrade HTSlib to version 1.23.1, 1.22.2, or 1.21.1 or later depending on the release branch in use (https://github.com/samtools/htslib/commit/6dd0d7d0e9e7e2e173a28969e624db8bc8bb5828 contains the fix). For immediate mitigation without patching, discard any .gzi index files from untrusted sources and regenerate them locally using bgzip -r on trusted BAM or BGZF files; this prevents loading of malicious index files. Organizations should prioritize patching given the RCE potential, and conduct inventory of dependent tools (SAMtools, BCFtools, etc.) to ensure consistent version updates across the HTSlib ecosystem.