What is the CVSS score of CVE-2026-31971?

CVE-2026-31971 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

Which versions of Htslib are affected by CVE-2026-31971?

Organizations using HTSlib face moderate risk from CVE-2026-31971, a stack-based buffer overflow vulnerability rated CVSS 7.1.. A patch is available.

How to fix or mitigate CVE-2026-31971?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Htslib CVE-2026-31971

EUVD-2026-12948 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-18 GitHub_M

Buffer Overflow Stack Overflow Heap Overflow Denial Of Service RCE Memory Corruption Debian Htslib

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 20:00 euvd

EUVD-2026-12948

Analysis Generated

Mar 18, 2026 - 20:00 vuln.today

CVE Published

Mar 18, 2026 - 19:55 nvd

HIGH 7.1

DescriptionGitHub Advisory

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTE_ARRAY_LEN method, the cram_byte_array_len_decode() failed to validate that the amount of data being unpacked matched the size of the output buffer where it was to be stored. Depending on the data series being read, this could result either in a heap or a stack overflow with attacker-controlled bytes. Depending on the data stream this could result either in a heap buffer overflow or a stack overflow. If a user opens a file crafted to exploit this issue it could lead to the program crashing, overwriting of data structures on the heap or stack in ways not expected by the program, or changing the control flow of the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

AnalysisAI

HTSlib, a widely-used bioinformatics library for reading and writing sequence alignment formats, contains a critical buffer overflow vulnerability in its CRAM format decoder. The vulnerability exists in the cram_byte_array_len_decode() function which fails to validate that unpacked data matches the output buffer size, affecting HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1. An attacker can craft a malicious CRAM file that, when opened by a user, triggers either a heap or stack overflow with attacker-controlled bytes, potentially leading to arbitrary code execution, program crash, or memory corruption.

Technical ContextAI

HTSlib (cpe:2.3:a:samtools:htslib) is a C library providing core functionality for reading and writing bioinformatics file formats including SAM, BAM, and CRAM. CRAM is a compressed sequence alignment format that uses multiple encoding and compression strategies to reduce file size. The vulnerability resides in the BYTE_ARRAY_LEN decoding method within the CRAM decoder, where the cram_byte_array_len_decode() function processes variable-length byte arrays. The root cause is classified under CWE-121 (Stack-based Buffer Overflow) and related heap overflow patterns, stemming from insufficient input validation. The decoder reads a length field and unpacks data without verifying that the actual data size matches the declared size or the allocated buffer capacity, allowing malicious input to write beyond buffer boundaries.

RemediationAI

Immediately upgrade HTSlib to version 1.23.1, 1.22.2, or 1.21.1 or later depending on your release line, as detailed in the GitHub security advisory at https://github.com/samtools/htslib/security/advisories/GHSA-jvx4-4wq7-6fmh. The upstream patch is available at https://github.com/samtools/htslib/commit/01cd003b46fa2ebea4d9be5475b11217eb4c11be. No workaround exists for this vulnerability; patching is the only mitigation. For applications unable to patch immediately, implement strict input validation by refusing CRAM files from untrusted sources, sandboxing HTSlib-dependent processes using OS-level isolation (containers, seccomp), and monitoring for unexpected process termination or memory access patterns. Verify that all downstream tools and pipelines (samtools, GATK, etc.) are updated to use patched HTSlib versions.