CVE-2026-31969

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31969
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31969.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31969
Aliases
  • GHSA-q4cj-f4h5-fqgc
Downstream
Published
2026-03-18T19:47:44.893Z
Modified
2026-08-12T15:32:22.061933Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
HTSlib CRAM decoder has a heap buffer overflow
Details

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTE_ARRAY_STOP method, an out-by-one error in the cram_byte_array_stop_decode_char() function check for a full output buffer could result in a single attacker-controlled byte being written beyond the end of a heap allocation. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31969.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-787"
    ]
}
References

Affected packages

Git / github.com/samtools/htslib

Affected ranges

Type
GIT
Repo
https://github.com/samtools/htslib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4d33bcb31831165a4d0dbf85114ff4085c0baf1f
Introduced
36f20e7c1f0bd4d094c4e91836f757caef16475a
Fixed
45034a719156b68705b9bbfba2156bfc2b4c6749
Introduced
86e74e065e39749d25636f8454773d9d898c5eb3
Fixed
88cdf69e4b83bb550ab4f6f7134892c2ad1978f4
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.21.1"
        },
        {
            "introduced": "1.22"
        },
        {
            "fixed": "1.22.2"
        },
        {
            "introduced": "1.23"
        },
        {
            "last_affected": "1.23"
        }
    ]
}

Affected versions

0.*
0.2.0-rc10
0.2.0-rc11
0.2.0-rc12
0.2.0-rc2
0.2.0-rc3
0.2.0-rc4
0.2.0-rc5
0.2.0-rc6
0.2.0-rc7
0.2.0-rc8
0.2.0-rc9
1.*
1.10.1
1.23
= 1.*
= 1.23
Other
stable1
stable2
vcf-direct-final

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 937.0,
            "function_hash": "318499094392947914069544457336782700155"
        },
        "id": "CVE-2026-31969-79c6ed37",
        "target": {
            "function": "cram_byte_array_stop_decode_char",
            "file": "cram/cram_codecs.c"
        },
        "source": "https://github.com/samtools/htslib/commit/88cdf69e4b83bb550ab4f6f7134892c2ad1978f4",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "331903852672426228182189481659407906217",
                "231505557052128974886150020351692488865",
                "168266229269832478522224481704706936783",
                "52058179051959824309871916307419727581",
                "304754019415293924046360036983096410430",
                "213804982865636118868719029918298571947",
                "10335522229165209106861821255741094080",
                "313907818465733301206091476224476902318",
                "230733879245714079709765039026535521860",
                "221760622419415016006053740645561406317",
                "329056314089706471022695045586600578785",
                "115778075697596639690905804146808181183",
                "235869936565809701063086672171316851946",
                "256137253364033928372139939151531364982",
                "35117948855852093616052861392319574905",
                "3864195136331481356143036291801626412",
                "187005887356531930348533704278538536564",
                "59000536546460458594400295064080750236",
                "285153078842246663571812468913419283669",
                "47624371699589156250563753148614882807",
                "269999851025677038831266449334792349053",
                "120290741727813235558028521541023712023",
                "318523828082473595425740871280274021646",
                "45546759834904525930632689541614211802",
                "276644997657476207869332953147381788938",
                "218869266925088080390266262238619733239",
                "95252602932708797718553681108639887469",
                "336947699371195827553061956671836457836"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-31969-c1379fc9",
        "target": {
            "file": "cram/cram_codecs.c"
        },
        "source": "https://github.com/samtools/htslib/commit/88cdf69e4b83bb550ab4f6f7134892c2ad1978f4",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31969.json"
vanir_signatures_modified 
"2026-08-12T15:32:22Z"