CVE-2026-31962: Htslib CRAM Buffer Overflow Vulnerability

CVE-2026-31962 Overview

CVE-2026-31962 is a heap buffer overflow vulnerability in HTSlib, a widely-used library for reading and writing bioinformatics file formats. The vulnerability exists in the cram_decode_seq() function which improperly handles certain CRAM alignment records that omit DNA sequence and quality values. When processing specially crafted CRAM files, the function fails to correctly manage these edge cases, resulting in an out-of-bounds memory access that reads a single byte beyond a heap allocation and subsequently writes an attacker-controlled byte to that same location.

Critical Impact

Successful exploitation could lead to application crashes, data corruption, or arbitrary code execution when processing malicious CRAM files.

Affected Products

• HTSlib versions prior to 1.21.1
• HTSlib versions 1.22.x prior to 1.22.2
• HTSlib version 1.23

Discovery Timeline

• 2026-03-18 - CVE-2026-31962 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-31962

Vulnerability Analysis

The vulnerability stems from improper handling of CRAM format alignment records within the cram_decode_seq() function. CRAM is a compressed file format designed to efficiently store DNA sequence alignment data. While most alignment records contain DNA sequence and quality values, the format specification allows records to omit this data in certain circumstances to reduce file size.

Due to specific quirks in the CRAM format, these omitted-data records still contain data that must be consumed and discarded during parsing. The cram_decode_seq() function fails to handle this scenario correctly in some edge cases. This improper handling results in the function reading a single byte from beyond the boundary of a heap-allocated buffer, followed by writing an attacker-controlled byte to that same out-of-bounds location.

This heap buffer overflow can be triggered when a user opens a maliciously crafted CRAM file. The consequences range from application crashes due to memory corruption to potential arbitrary code execution if an attacker can precisely control the heap layout and the written byte value.

Root Cause

The root cause is a boundary condition error (CWE-122: Heap-based Buffer Overflow) in the cram_decode_seq() function. The function fails to properly account for CRAM alignment records that omit sequence and quality data, leading to incorrect buffer boundary calculations during the decode operation.

Attack Vector

This vulnerability is exploited via network delivery of malicious CRAM files. An attacker would craft a CRAM file that triggers the vulnerable code path in cram_decode_seq(). The attack requires user interaction—specifically, the victim must open the malicious file using an application that relies on HTSlib for CRAM file processing. Bioinformatics pipelines, genome analysis tools, and scientific research applications commonly use HTSlib, making research institutions and healthcare organizations potential targets.

The exploitation process involves:

1. Crafting a CRAM file with alignment records specifically designed to trigger the improper handling in cram_decode_seq()
2. Delivering the file to the victim via email attachment, file sharing, or other distribution methods
3. Victim opens the file with a vulnerable HTSlib-based application
4. The heap buffer overflow occurs, potentially allowing code execution

Detection Methods for CVE-2026-31962

Indicators of Compromise

• Unexpected crashes in applications using HTSlib when processing CRAM files
• Abnormal memory access patterns or segmentation faults during bioinformatics file processing
• Presence of suspicious or unexpected CRAM files in processing directories
• Unusual application behavior following CRAM file parsing operations

Detection Strategies

• Monitor for application crashes with stack traces referencing cram_decode_seq() or related HTSlib functions
• Implement file integrity monitoring on bioinformatics data directories to detect introduction of malicious CRAM files
• Deploy endpoint detection solutions capable of identifying heap corruption exploitation attempts
• Review application logs for errors related to CRAM file parsing failures

Monitoring Recommendations

• Enable verbose logging for HTSlib-based applications to capture parsing errors
• Monitor memory allocation patterns for applications processing CRAM files
• Implement network traffic analysis to detect potentially malicious CRAM files being delivered via email or file transfer
• Establish baseline behavior for bioinformatics applications to identify anomalous activity

How to Mitigate CVE-2026-31962

Immediate Actions Required

• Upgrade HTSlib to patched versions 1.21.1, 1.22.2, or 1.23.1 immediately
• Audit systems and applications to identify all instances of HTSlib usage
• Restrict processing of CRAM files from untrusted sources until patching is complete
• Notify users of bioinformatics applications about the vulnerability and remediation steps

Patch Information

The HTSlib maintainers have released security patches in versions 1.21.1, 1.22.2, and 1.23.1 that address this heap buffer overflow vulnerability. The fix is available in commit d799b54c6401879187bba4741be83ff590ac73e3. Organizations should consult the GitHub Security Advisory GHSA-xxmp-v7h3-gpwp for complete details on affected versions and upgrade paths.

Workarounds

• No official workarounds are available for this vulnerability according to the vendor advisory
• As a temporary measure, avoid processing CRAM files from untrusted or unknown sources
• Consider implementing application sandboxing to limit the impact of potential exploitation
• Prioritize patching as the only reliable remediation method

# Upgrade HTSlib to patched version
# For version 1.21.x series:
git clone https://github.com/samtools/htslib.git
cd htslib
git checkout v1.21.1
make && make install

# Verify installed version
htsfile --version