EUVD-2026-12956Severity by source
Sources disagree (Medium–Critical)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
SAMtools is a program for reading, manipulating and writing bioinformatics file formats. The mpileup command outputs DNA sequences that have been aligned against a known reference. On each output line it writes the reference position, optionally the reference DNA base at that position (obtained from a separate file) and all of the DNA bases that aligned to that position. As the output is ordered by position, reference data that is no longer needed is discarded once it has been printed out. Under certain conditions the data could be discarded too early, leading to an attempt to read from a pointer to freed memory. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. This bug is fixed in versions 1.21.1 and 1.22. There is no workaround for this issue.
AnalysisAI
SAMtools mpileup command contains a use-after-free vulnerability in reference data management that can leak sensitive program state information or trigger application crashes when processing aligned DNA sequences. The vulnerability affects versions prior to 1.2 and requires no authentication or user interaction to exploit, though a patch is not yet available. An attacker could leverage this to obtain information disclosure or cause denial of service against systems processing bioinformatics data with vulnerable SAMtools versions.
Technical ContextAI
SAMtools is a bioinformatics utility suite used for processing DNA sequence alignment files (BAM/SAM formats). The mpileup command specifically reads aligned sequences and outputs them alongside reference sequence data obtained from a separate reference file. The vulnerability is rooted in CWE-416 (use-after-free), a memory safety defect where the reference data buffer is deallocated prematurely based on position ordering assumptions. When certain input conditions occur, the code attempts to access reference positions that have already been freed, causing the program to dereference invalid memory pointers. The affected product is identified by CPE cpe:2.3:a:samtools:samtools:*:*:*:*:*:*:*:*, indicating all versions below the patched releases are in scope.
RemediationAI
Upgrade SAMtools to version 1.21.1 or 1.22 (or later) immediately, as these are the confirmed patched versions addressing this use-after-free condition. The fix is available in the upstream repository at commit 3036eb9af945fcef359427a2d359855553da4adf. No workaround is available for this vulnerability according to the official advisory, so patching is mandatory. For organizations unable to update immediately, restrict mpileup command execution to trusted, validated sequencing data sources and implement process isolation or containerization to limit the blast radius of potential crashes.
The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insec
HTSlib contains a heap buffer overflow vulnerability in its CRAM decoder caused by an out-by-one error when validating f
HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain a heap buffer overflow vulnerability in the cram_decode_seq(
HTSlib contains a buffer overflow vulnerability in its CRAM format decoder affecting the VARINT and CONST encoding handl
HTSlib, a widely-used bioinformatics library for reading and writing sequence alignment formats, contains a critical buf
HTSlib versions prior to 1.21.1, 1.22.2, and 1.23.1 contain an out-by-one error in the CRAM decoder's `cram_byte_array_s
HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain a heap buffer overflow vulnerability in the GZI index loadin
HTSlib, a bioinformatics library for reading and writing sequence alignment formats, contains a null pointer dereference
HTSlib contains an out-of-bounds read vulnerability in the cram_decode_slice() function that fails to validate the refer
HTSlib versions prior to 1.23.1, 1.22.2, and 1.21.1 contain an out-of-bounds read vulnerability in the CRAM file parser
HTSlib versions prior to 1.21.1, 1.22.2, and 1.23.1 contain a buffer over-read vulnerability in the CRAM decoder's cram_
SAMtools versions 1.17 and later contain a null pointer dereference vulnerability in the cram-size command due to missin
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today