CVE-2026-116742 Details
Description
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.
A heap out-of-bounds write vulnerability has been identified in HTSlib versions through 1.24. The issue arises in the BGZF index loader function 'bgzf_index_load_hfile' within 'bgzf.c'. Attackers can exploit this vulnerability by providing a crafted .gzi index entry count, leading to heap memory corruption. Specifically, a count of 0xFFFFFFFF causes an integer truncation, allowing writes beyond a zero-sized buffer allocated by 'malloc(0)'. This out-of-bounds write is followed by an out-of-bounds read in 'bgzf_useek()', resulting in heap corruption. The vulnerability can cause crashes in tools such as samtools and bcftools.
Users can update to HTSlib version 1.25 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/samtools/htslib | [email protected] | Vendor |
| https://github.com/samtools/htslib/blob/1.24/bgzf.c#L2504 | [email protected] | Source CodeVendor |
| https://github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2873 | [email protected] | Source CodeVendor |
| https://github.com/samtools/htslib/issues/2113 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/samtools/htslib/pull/2057 | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/htslib-bgzf-gzi-int-truncation-oob | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/htslib-through-1.24-heap-out-of-bounds-write-via-truncated-gzi-index-count | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-197 | Numeric Truncation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HTSlib | <= 1.24 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |