CVE-2026-31962: 
NixOS vulnerability analysis and mitigation

CVE-2026-31962 is a heap buffer overflow vulnerability in HTSlib's cram_decode_seq() function when processing malformed CRAM bioinformatics alignment files. It affects HTSlib versions ≤ 1.21, 1.22, and 1.22.1, as well as version 1.23. The vulnerability was disclosed on March 18, 2026, by the samtools/htslib maintainers via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Red Hat).

The root cause lies in improper handling of CRAM records that omit sequence and quality data (CWE-122: Heap-based Buffer Overflow, CWE-125: Out-of-bounds Read, CWE-787: Out-of-bounds Write, CWE-129: Improper Validation of Array Index). In the CRAM format, records with no stored sequence still require dummy data to be consumed and discarded; the cram_decode_seq() function failed to check whether cr->len == 0 before performing memory operations, resulting in a one-byte out-of-bounds read from beyond a heap allocation followed by writing a single attacker-controlled byte to that same location. The fix (commit d799b54) adds cr->len guards throughout the function to suppress writes to seq and qual buffers when sequence length is zero (GitHub Commit, GitHub Advisory).

Successful exploitation can cause the affected application to crash (denial of service) or allow an attacker to overwrite heap structures and data in unintended ways, potentially leading to arbitrary code execution. All three CIA pillars are affected: confidentiality (potential memory disclosure), integrity (heap data corruption), and availability (application crash). Any tool or pipeline built on HTSlib — including samtools, bcftools, and downstream bioinformatics workflows — that processes untrusted CRAM files is at risk (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been observed as of the time of this report (Feedly). The EPSS score is approximately 0.076%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a user to open a specially crafted CRAM file, which can be delivered remotely (e.g., via a shared file, download link, or data pipeline), making social engineering a viable attack vector (GitHub Advisory).

1. Craft a malicious CRAM file: Create a CRAM file containing alignment records where the sequence and quality data are omitted (i.e., cram_record::len is set to 0), but with crafted dummy feature data designed to trigger the off-by-one heap read/write in cram_decode_seq().
2. Deliver the file to the target: Distribute the malicious CRAM file to a target user or system via email attachment, shared storage, a bioinformatics data repository, or a network-accessible pipeline that automatically processes CRAM files.
3. Trigger parsing: The target user or automated process opens the file using an HTSlib-based tool (e.g., samtools view, bcftools, or a custom application linking HTSlib ≤ 1.21, 1.22/1.22.1, or 1.23).
4. Heap overflow occurs: The cram_decode_seq() function reads one byte beyond the end of a heap allocation and writes an attacker-controlled byte to that location, corrupting heap metadata or adjacent data structures.
5. Achieve code execution or crash: Depending on heap layout and attacker control over the written byte, the outcome ranges from application crash (DoS) to potential arbitrary code execution by manipulating heap structures to redirect control flow (GitHub Advisory, GitHub Commit).

• Process: Unexpected crashes or segmentation faults in HTSlib-based tools (e.g., samtools, bcftools) when processing CRAM files, particularly with core dumps referencing cram_decode_seq().
• Logs: Application error logs showing memory corruption errors, heap corruption messages, or abort signals (SIGABRT, SIGSEGV) originating from CRAM file parsing operations.
• File System: Presence of unexpected or externally sourced CRAM files in processing directories, especially files with anomalous structure (zero-length sequence records with feature data).
• Network: Unusual inbound transfers of CRAM files from untrusted or external sources to systems running bioinformatics pipelines.

Upgrade HTSlib to one of the patched versions: 1.23.1, 1.22.2, or 1.21.1, depending on the currently deployed branch. There is no configuration-based workaround available for this vulnerability. As an interim measure, restrict CRAM file processing to files sourced exclusively from trusted, verified sources, and monitor systems for unexpected crashes in HTSlib-based applications (GitHub Advisory, Red Hat).

Red Hat tracked the vulnerability via Bugzilla (Bug 2448750) and assigned it high priority and severity, indicating concern for downstream Linux distributions shipping HTSlib-based packages such as samtools and bcftools. Coverage appeared on oss-security mailing lists and Linux distribution security channels, including Fedora update notices and German Linux security news (pro-linux.de). No major independent researcher commentary or broad social media discussion has been identified beyond standard vulnerability aggregator coverage (Red Hat Bugzilla, oss-sec).