CVE-2026-31967 - Vulnerability Analysis

Overview

HTSlib contains an out of bounds read caused by lack of validation of mate reference id in cram_decode_slice(), letting attackers cause information disclosure or program crash, exploit requires crafted CRAM input.

Severity & Score

Impact

Attackers can cause information leakage or program crash, potentially disrupting service or exposing sensitive data.

Mitigation

Update to versions 1.23.1, 1.22.2, 1.21.1 or later.

References

• https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357
• https://github.com/samtools/htslib/security/advisories/GHSA-33x5-c6vj-8f2w

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 19, 2026

🔴 CVE-2026-31967 - Critical (9.1) HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, the value of the mate reference... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31967/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner