samtools htslib vulnerabilities

Latest samtools htslib CVEs

Newest publication first

1. CVE-2026-116742 HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count

   Published 2026-10-26

   Medium·CVSS 4.8 EPSS 0.12%

   HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a mal...

2. CVE-2026-31971 HTSlib CRAM decoder vulnerable to buffer overflow

   Published 2026-03-18

   High·CVSS 7.1 EPSS 0.36%

   HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTE_ARRAY_LEN method, the cram_byte_array_len_d...

3. CVE-2026-31970 HTSlib BGZF index file reader has a heap buffer overflow

   Published 2026-03-18

   High·CVSS 7.1 EPSS 0.48%

   HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, bgzf_index_load_hfile(), it was possible to trigger an integer overflow, leading to an under- or zero-sized buffer...

4. CVE-2026-31969 HTSlib CRAM decoder has a heap buffer overflow

   Published 2026-03-18

   High·CVSS 7.1 EPSS 0.36%

   HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTE_ARRAY_STOP method, an out-by-one error in t...

5. CVE-2026-31968 HTSlib CRAM decoder vulnerable to buffer overflow

   Published 2026-03-18

   High·CVSS 8.8 EPSS 0.43%

   HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. For the VARINT and CONST encodings, incomplete validation of the context in which th...

6. CVE-2026-31967 HTSlib CRAM reader has out-of-bounds read due to improper validation of input

   Published 2026-03-18

   Medium·CVSS 6.9 EPSS 0.47%

   HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cram_decode_slice() function called while reading CRAM records, the value of the mate reference id field was not validated. Later...

7. CVE-2026-31966 HTSlib CRAM reader has out-of-bounds read due to improper validation of input

   Published 2026-03-18

   Medium·CVSS 6.9 EPSS 0.55%

   HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each ali...

8. CVE-2026-31965 HTSlib CRAM reader has out-of-bounds reads due to improper validation of input

   Published 2026-03-18

   Medium·CVSS 6.9 EPSS 0.40%

   HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cram_decode_slice() function called while reading CRAM records, validation of the reference id field occurred too late, allowing t...

9. CVE-2026-31964 HTSlib CRAM decoder has a NULL Pointer Dereference

   Published 2026-03-18

   Medium·CVSS 6.9 EPSS 0.34%

   HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. While most alignment records store DNA sequence and quality values, the format also...

10. CVE-2026-31963 HTSlib CRAM reader has heap buffer overflow due to improper validation of input

    Published 2026-03-18

    High·CVSS 8.8 EPSS 0.37%

    HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each ali...

11. CVE-2026-31962 HTSlib CRAM reader has heap buffer overflow due to improper validation of input

    Published 2026-03-18

    High·CVSS 8.8 EPSS 0.38%

    HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to sav...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.