What is the CVSS score of CVE-2026-31973?

CVE-2026-31973 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Which versions of Samtools are affected by CVE-2026-31973?

Organizations using SAMtools should be aware of notable risk from CVE-2026-31973, a null pointer dereference vulnerability rated CVSS 6.9.. A patch is available.

How to fix or mitigate CVE-2026-31973?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Samtools CVE-2026-31973

EUVD-2026-12958 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-03-18 GitHub_M

Denial Of Service Samtools Suse

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.22.2,1.21.1

EUVD ID Assigned

Mar 18, 2026 - 21:00 euvd

EUVD-2026-12958

Analysis Generated

Mar 18, 2026 - 21:00 vuln.today

CVE Published

Mar 18, 2026 - 20:34 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the cram_decode_compression_header() was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

AnalysisAI

SAMtools versions 1.17 and later contain a null pointer dereference vulnerability in the cram-size command due to missing error handling for the cram_decode_compression_header() function. When this function fails and returns an error, the code does not properly validate the return value before dereferencing the pointer, allowing an attacker to crash the application by providing a malformed CRAM file. This is a denial-of-service vulnerability with no active exploitation reported in the wild, though patches are available in versions 1.23.1, 1.22.2, and 1.21.1.

Technical ContextAI

SAMtools (cpe:2.3:a:samtools:samtools:*:*:*:*:*:*:*:*) is a widely-used bioinformatics utility for manipulating sequence alignment map (SAM), BAM, and CRAM file formats. The vulnerability exists specifically in the cram-size subcommand, which analyzes CRAM file compression efficiency. The root cause is classified as CWE-476 (Null Pointer Dereference), which occurs when the cram_decode_compression_header() function encounters malformed CRAM file headers and returns an error condition. The vulnerable code path fails to check the function's return value before using the resulting pointer, leading to a dereference of a null or invalid memory address. CRAM is a reference-based compression format for genomic sequencing data, making SAMtools critical infrastructure in bioinformatics pipelines.

RemediationAI

Upgrade SAMtools to version 1.23.1, 1.22.2, or 1.21.1 or later, depending on your currently deployed version. The fix is implemented in commit 06fc2a219b3d7c94d3f412c09f6d1efd51199f2f, which adds proper error checking for the cram_decode_compression_header() function return value. No workaround exists for this issue, making patching mandatory. Users unable to upgrade immediately should restrict execution of the cram-size command to trusted administrators and validate all input CRAM files using alternative tools before processing them with SAMtools. Consult the GitHub security advisory at https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43 for detailed patch notes and deployment guidance.