CVE-2026-31967: Htslib Information Disclosure Flaw

CVE-2026-31967 Overview

CVE-2026-31967 is an Out-of-Bounds Read vulnerability affecting HTSlib, a widely-used library for reading and writing bioinformatics file formats. The vulnerability exists in the cram_decode_slice() function, which is called during the processing of CRAM (Compressed Reference-oriented Alignment Map) files. CRAM is a compressed format used for storing DNA sequence alignment data.

The flaw occurs because the mate reference ID field value is not properly validated during CRAM record decoding. When this unvalidated value is subsequently used—such as during conversion to SAM format—it can result in out-of-bounds array reads when looking up corresponding reference names. This can lead to information leakage about program state and potential program crashes due to invalid memory access attempts.

Critical Impact

Exploitation of this vulnerability may leak sensitive program state information and cause denial of service through memory access violations in bioinformatics applications processing malicious CRAM files.

Affected Products

• HTSlib versions prior to 1.21.1
• HTSlib versions 1.22.x prior to 1.22.2
• HTSlib version 1.23

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-31967 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-31967

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read). The root issue stems from insufficient input validation in the CRAM file parsing logic within HTSlib. When processing CRAM records, the library reads a mate reference ID field from the input file without verifying that this value falls within the valid bounds of the reference name array.

The impact of this vulnerability is twofold. First, if the out-of-bounds array read returns a value that happens to be interpretable as a valid memory pointer, the library will attempt to dereference it as a string pointer during SAM format conversion. This behavior could expose memory contents that should not be accessible, resulting in information disclosure about the program's internal state. Second, if the accessed memory location is invalid or protected, the resulting access violation will crash the application, causing a denial of service condition.

The network-based attack vector indicates that exploitation can occur by delivering malicious CRAM files to applications using vulnerable HTSlib versions, such as through web-based bioinformatics pipelines or file processing services.

Root Cause

The vulnerability originates from missing bounds checking on the mate reference ID field in the cram_decode_slice() function within cram/cram_decode.c. When CRAM records are decoded, the mate reference ID is read from the file without validation against the actual size of the reference name array. This allows an attacker to craft a CRAM file with an out-of-bounds mate reference ID value, triggering memory access outside the intended array boundaries.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious CRAM file containing an invalid mate reference ID value. When a vulnerable application processes this file—particularly when converting CRAM data to SAM format—the out-of-bounds read is triggered. The attack can be delivered through any mechanism that causes the target system to process attacker-controlled CRAM files, including:

• Direct file upload to bioinformatics processing pipelines
• Network-based file transfer services
• Automated data ingestion systems in genomics research environments

The security patch adds validation checks for both the CRAM ref ID and mate ref ID fields to ensure they fall within valid bounds before use:

/*
-Copyright (c) 2012-2020, 2022-2025 Genome Research Ltd.
+Copyright (c) 2012-2020, 2022-2026 Genome Research Ltd.
 Author: James Bonfield <jkb@sanger.ac.uk>

 Redistribution and use in source and binary forms, with or without

Source: GitHub Commit Update

Detection Methods for CVE-2026-31967

Indicators of Compromise

• Unexpected application crashes when processing CRAM files, particularly with segmentation faults or access violations
• Memory access errors logged during CRAM to SAM format conversions
• Unusual CRAM files with abnormally large or negative mate reference ID values

Detection Strategies

• Implement file integrity checking for incoming CRAM files before processing
• Monitor bioinformatics applications for abnormal memory access patterns or unexpected crashes during file processing
• Deploy application-level logging to capture CRAM parsing errors and reference ID validation failures

Monitoring Recommendations

• Enable verbose logging in applications using HTSlib to capture parsing errors and validation failures
• Monitor system logs for segmentation faults or memory access violations in bioinformatics tools
• Establish alerting for repeated crashes in CRAM file processing workflows

How to Mitigate CVE-2026-31967

Immediate Actions Required

• Upgrade HTSlib to patched versions: 1.23.1, 1.22.2, or 1.21.1 depending on your version branch
• Review and audit any systems processing untrusted CRAM files for potential exposure
• Implement input validation at the application layer to supplement library-level fixes

Patch Information

HTSlib has released security patches in versions 1.23.1, 1.22.2, and 1.21.1 that add proper bounds checking for CRAM reference ID and mate reference ID fields. The fix ensures these values are validated against the reference name array size before use. Detailed information is available in the GitHub Security Advisory GHSA-33x5-c6vj-8f2w and the GitHub Commit Update.

Workarounds

• There is no workaround for this vulnerability according to the vendor advisory
• Organizations must upgrade to the patched versions to remediate this issue
• Consider isolating systems that process untrusted CRAM files until patches can be applied

# Upgrade HTSlib to patched version
# For systems using version 1.23.x:
git clone https://github.com/samtools/htslib.git
cd htslib
git checkout tags/1.23.1
make && make install