CVE-2026-31973

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31973
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31973.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31973
Aliases
  • GHSA-x86f-q6fj-cm43
Downstream
Published
2026-03-18T20:34:00.846Z
Modified
2026-08-12T15:32:20.262202Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
NULL pointer dereference in samtools cram-size
Details

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the cram_decode_compression_header() was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31973.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/samtools/samtools

Affected ranges

Type
GIT
Repo
https://github.com/samtools/samtools
Events
Introduced
4959cc981ad9725d3c6007687ca372ffcdaa3c80
Last affected
063c0ed98dcfe9d64238098c693713cd915d7532
Introduced
da72567097265a61650a081c9f68d4a9f45bd105
Fixed
b74903f69aa69a8435a2b5d66b2a6ca67f381a8e
Introduced
32e616e651459318696b0810248060400618374c
Fixed
06fc2a219b3d7c94d3f412c09f6d1efd51199f2f
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:samtools:samtools:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:samtools:samtools:1.23:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.17"
        },
        {
            "last_affected": "1.21.1"
        },
        {
            "introduced": "1.22"
        },
        {
            "fixed": "1.22.2"
        },
        {
            "introduced": "1.23"
        },
        {
            "last_affected": "1.23"
        }
    ]
}

Affected versions

1.*
1.23
= 1.*
= 1.23

Database specific

vanir_signatures_modified 
"2026-08-12T15:32:20Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31973.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "target": {
            "file": "cram_size.c",
            "function": "main_cram_size"
        },
        "id": "CVE-2026-31973-02aafcad",
        "signature_version": "v1",
        "digest": {
            "function_hash": "254310584608370210697700961491219706261",
            "length": 1533.0
        },
        "source": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "target": {
            "file": "cram_size.c"
        },
        "id": "CVE-2026-31973-26f04ed6",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "291437655908264484176112766188196650725",
                "143555089471973266180330542232976457665",
                "209448727847962945100743129922385945709",
                "96300466505532565825557882361735933097",
                "94563996022927879658295969450230716727",
                "26444550539555756114567569354931167799",
                "155800386562255349937703831046304917578",
                "142929857891520982117199820792650036138",
                "144590984420228013412976767293248333477",
                "224494977928779077559110037589693226588",
                "135150568860639148424693251568563722313",
                "134770987951680540905293203195812380586",
                "293878082364052759128026929785283065342",
                "18895997584283124756099286096509285426",
                "178042052634451875503295327640092087137",
                "153584621215615035223707669759738390999",
                "61586457859378006444030453365450089823",
                "244179043536484476703345097763521259816",
                "36014334991835432361695189176187925219",
                "44643424144268969604536948028906623575",
                "137907962610211177212746469110140556300",
                "70640637503054260360970948529678974450",
                "201118397383981537552215139604151758561",
                "87531745572545414972260764437917022482",
                "297430539449623781187316172710649937521",
                "303415437738540148667235882242556534624",
                "44644356958269854849887991339236618913",
                "284323807069134950123685677269524142324",
                "337544489456359786392788139096795197914"
            ]
        },
        "source": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "file": "cram_size.c",
            "function": "cram_size"
        },
        "id": "CVE-2026-31973-2e353134",
        "signature_version": "v1",
        "digest": {
            "function_hash": "208623663330854296480414934067465379395",
            "length": 3382.0
        },
        "source": "https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f",
        "signature_type": "Function"
    }
]