CVE-2026-31964: Htslib CRAM Format DOS Vulnerability

CVE-2026-31964 Overview

CVE-2026-31964 is a NULL Pointer Dereference vulnerability affecting HTSlib, a widely used C library for reading and writing high-throughput sequencing data in bioinformatics file formats. The vulnerability exists in the CRAM format handling code, specifically within the CONST, XPACK, and XRLE encodings that fail to properly implement the interface needed to handle records with omitted sequence or quality data.

CRAM is a compressed format that stores DNA sequence alignment data using various encodings and compression methods. While most alignment records store DNA sequence and quality values, the format allows them to omit this data in certain cases to save space. Due to quirks of the CRAM format, these records need careful handling as they store data that must be consumed and then discarded. The vulnerable encodings did not properly implement this behavior, leading to an attempt to write to a NULL pointer when processing such records.

Critical Impact

Exploitation of this vulnerability causes a NULL pointer dereference, typically resulting in program crashes. This can lead to denial of service conditions affecting bioinformatics processing pipelines and research workflows that depend on HTSlib for sequencing data analysis.

Affected Products

• HTSlib versions prior to 1.21.1
• HTSlib versions 1.22.x prior to 1.22.2
• HTSlib version 1.23 (fixed in 1.23.1)

Discovery Timeline

• 2026-03-18 - CVE-2026-31964 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-31964

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The root cause lies in the CRAM codec implementation within HTSlib where the CONST, XPACK, and XRLE encodings fail to check for NULL output buffers before attempting write operations.

When processing CRAM-formatted alignment records that have omitted sequence or quality data, the library must handle a specific edge case where the output buffer (out) may be NULL. In normal operation, the codec functions would write decoded data to this buffer. However, when records omit sequence or quality data to save space, the format requires that the data be consumed and discarded rather than written to an output buffer. The affected encodings did not account for this scenario, proceeding to write to the NULL pointer.

The network attack vector indicates that maliciously crafted CRAM files could be delivered remotely to trigger this vulnerability in applications using HTSlib for file processing.

Root Cause

The vulnerability stems from missing NULL pointer validation in the CRAM codec processing functions. The CONST, XPACK, and XRLE encoding handlers in cram/cram_codecs.c did not verify that the output buffer pointer (out) was valid before attempting to write data to it. When the CRAM format specifies that sequence or quality data should be omitted, the calling code passes a NULL output buffer, expecting the codec to simply consume and discard the data. Without proper NULL checks, this resulted in undefined behavior and crashes.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious CRAM file that contains alignment records with omitted sequence or quality data, encoded using the CONST, XPACK, or XRLE methods. When a vulnerable HTSlib-based application attempts to decode this file, the codec functions will attempt to dereference the NULL output pointer, causing the application to crash. This represents a denial of service attack vector that could disrupt bioinformatics processing pipelines, research workflows, or any system that processes untrusted CRAM files.

// Security patch for CONST codec in cram/cram_codecs.c
// Source: https://github.com/samtools/htslib/commit/e64e68da567d2309509d059ace016d5d7fc7514f

                            cram_block *in, char *out, int *out_size) {
     int i, n;
 
+    if (!out)
+        return 0;
+
     for (i = 0, n = *out_size; i < n; i++)
         out[i] = c->u.xconst.val;

The patch adds a critical NULL pointer check at the beginning of the codec function. If the out parameter is NULL, the function returns early with a success status (0), properly handling the case where data should be consumed and discarded without writing to an output buffer.

Detection Methods for CVE-2026-31964

Indicators of Compromise

• Application crashes with segmentation faults when processing CRAM files
• Crash dumps indicating NULL pointer dereference in cram_codecs.c or related codec functions
• Unusual CRAM files with specific encoding configurations targeting CONST, XPACK, or XRLE codecs
• Repeated processing failures of CRAM-formatted sequencing data

Detection Strategies

• Monitor application stability for HTSlib-dependent bioinformatics tools when processing CRAM files
• Implement crash monitoring and core dump analysis for services that handle untrusted CRAM data
• Use memory safety tools (AddressSanitizer, Valgrind) during development and testing to detect NULL pointer dereferences
• Review system logs for repeated segmentation faults in bioinformatics processing pipelines

Monitoring Recommendations

• Enable crash reporting for applications using HTSlib to detect exploitation attempts
• Monitor file processing queues for failures associated with CRAM file handling
• Implement input validation and file integrity checking before processing untrusted CRAM files
• Consider sandboxing HTSlib-based applications to limit the impact of crashes

How to Mitigate CVE-2026-31964

Immediate Actions Required

• Upgrade HTSlib to version 1.23.1, 1.22.2, or 1.21.1 depending on your current version branch
• Identify all applications and pipelines in your environment that depend on HTSlib
• Audit bioinformatics workflows for processing of untrusted or external CRAM files
• Consider temporarily restricting CRAM file processing from untrusted sources until patching is complete

Patch Information

Fixed versions have been released by the HTSlib maintainers:

• Version 1.23.1 - Fix for users on the 1.23.x branch
• Version 1.22.2 - Fix for users on the 1.22.x branch
• Version 1.21.1 - Fix for users on the 1.21.x branch

The security fix is documented in the GitHub Security Advisory GHSA-5w97-85gf-86rm and the patch can be reviewed in the GitHub commit e64e68da567d2309509d059ace016d5d7fc7514f.

Workarounds

• There is no workaround for this issue according to the vendor advisory
• The only mitigation is to upgrade to a patched version of HTSlib
• Avoid processing untrusted CRAM files until the library is updated

# Example: Updating HTSlib from source
git clone https://github.com/samtools/htslib.git
cd htslib
git checkout tags/1.23.1
make
sudo make install