CVE-2026-31969: falha de alta gravidade em samtools htslib
HTSlib CRAM decoder has a heap buffer overflow
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the `BYTE_ARRAY_STOP` method, an out-by-one error in the `cram_byte_array_stop_decode_char()` function check for a full output buffer could result in a single attacker-controlled byte being written beyond the end of a heap allocation. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
samtools · htslibCVEs relacionadas — samtools htslib
No mesmo produto, das mais perigosas para as menos.
CVE-2026-31966MEDIUMHTSlib CRAM reader has out-of-bounds read due to improper validation of inputEPSS 0.5%CVE-2026-31970HIGHHTSlib BGZF index file reader has a heap buffer overflowEPSS 0.5%CVE-2026-31967MEDIUMHTSlib CRAM reader has out-of-bounds read due to improper validation of inputEPSS 0.5%CVE-2026-31968HIGHHTSlib CRAM decoder vulnerable to buffer overflowEPSS 0.4%CVE-2026-31965MEDIUMHTSlib CRAM reader has out-of-bounds reads due to improper validation of inputEPSS 0.4%CVE-2026-31962HIGHHTSlib CRAM reader has heap buffer overflow due to improper validation of inputEPSS 0.4%