CVE-2026-31965 Details
Description
HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected. The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
A vulnerability allowing out-of-bounds reads has been identified in HTSlib, a library for handling bioinformatics file formats. This issue arises in the CRAM decoding process, specifically within the 'cram_decode_slice()' function. The vulnerability is caused by improper validation of reference ID fields, which allows invalid data to be read before the error is detected. While this bug could potentially lead to a program crash or the leakage of two values to the caller, the error handling in place may complicate exploitation. Affected versions include HTSlib versions 1.21 and prior, as well as 1.22, 1.22.1, and 1.23. The vulnerability has been patched in versions 1.21.1, 1.22.2, and 1.23.1.
Users can upgrade to HTSlib versions 1.21.1, 1.22.2, or 1.23.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| htslib htslib | < 1.21.1 >= 1.22, < 1.22.2 1.23 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |