CVE-2026-31963: 
NixOS vulnerability analysis and mitigation

CVE-2026-31963 is a heap buffer overflow vulnerability in HTSlib's CRAM file decoder, caused by an off-by-one error in the validation of CRAM feature positions relative to the record sequence boundary. An attacker can craft a malicious CRAM file that, when opened by a user, triggers an invalid write of one attacker-controlled byte beyond the end of a heap buffer. Affected versions include HTSlib ≤ 1.21, 1.22, 1.22.1, and 1.23; fixed versions are 1.21.1, 1.22.2, and 1.23.1. The vulnerability was disclosed on March 18, 2026, with a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-193) in the CRAM decoder within cram/cram_decode.c, specifically in the cram_decode_seq function, where the boundary check for CRAM features positioned beyond the end of the record sequence was insufficiently strict (CWE-129, CWE-122, CWE-787). The original check used pos > cr->len+1 for all feature types, but certain operations (e.g., substitutions, insertions) that write to the sequence/quality buffers must not be placed after cr->len, while non-writing operations (deletions, ref skips, padding, hard clips) may legitimately appear at cr->len+1. The fix, committed as 8bcc990, differentiates between feature types and applies the correct boundary per operation type (GitHub Commit, GitHub Advisory). Exploitation requires a user to open a specially crafted CRAM file; no authentication or elevated privileges are required beyond this user interaction.

Successful exploitation can lead to program crashes (denial of service), corruption of heap data structures, and potentially arbitrary code execution in the context of the user running the affected application. The integrity and availability of the affected system are at high risk, while confidentiality impact is assessed as none in the primary scoring. Because HTSlib is widely used in bioinformatics pipelines and tools (e.g., samtools, bcftools), exploitation could affect genomic data processing workflows and any downstream systems that depend on them (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). No threat actor attribution has been reported. The EPSS score is approximately 0.076%, reflecting a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (opening a malicious CRAM file), which somewhat limits automated exploitation scenarios.

1. Craft a malicious CRAM file: Create a CRAM file containing a CRAM record with a feature (e.g., a substitution or insertion) whose position is set to exactly cr->len + 1 — one byte beyond the end of the stored sequence — exploiting the off-by-one boundary check in the vulnerable cram_decode_seq function.
2. Deliver the file to the target: Distribute the crafted CRAM file via email, file sharing, a compromised data repository, or any channel where a bioinformatics user would open it (e.g., a public genomics data portal).
3. Trigger decoding: The victim opens the file using an HTSlib-linked application (e.g., samtools view, bcftools, or a custom pipeline tool). HTSlib's CRAM decoder processes the malicious feature record.
4. Trigger heap buffer overflow: The off-by-one error allows writing one attacker-controlled byte beyond the end of a heap-allocated buffer, corrupting adjacent heap metadata or data structures.
5. Achieve code execution or crash: Depending on heap layout and memory allocator behavior, the corruption may cause a program crash (denial of service) or, with further heap grooming, enable arbitrary code execution in the context of the user running the tool (GitHub Advisory, GitHub Commit).

• Process: Unexpected crashes or segmentation faults in HTSlib-linked applications (e.g., samtools, bcftools) when processing CRAM files, particularly with error messages referencing feature position validation in CRAM decoding.
• Logs: Application logs containing HTSlib error messages such as Feature position X after end of read or abnormal termination signals (SIGSEGV, SIGABRT) from bioinformatics tools processing CRAM files.
• File System: Presence of unexpected or externally sourced CRAM files in data directories, especially files with unusual feature records or anomalous record lengths.
• Network: Unusual downloads of CRAM files from untrusted or unexpected external sources into bioinformatics processing environments.

Users should upgrade HTSlib to the patched versions: 1.21.1 (for 1.21.x branch), 1.22.2 (for 1.22.x branch), or 1.23.1 (for 1.23.x branch). There is no workaround available for this vulnerability — patching is the only remediation. As an interim measure, organizations should restrict processing of CRAM files from untrusted sources and monitor for unexpected crashes in HTSlib-linked tools until patches are applied (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by HTSlib maintainer daviesrob via a GitHub Security Advisory on March 18, 2026, with an accompanying fix commit. Red Hat tracked the issue via Bugzilla and the OSS security mailing list (oss-sec) also carried a disclosure notice. Coverage appeared on Linux community sites noting security updates for related packages (bcftools, samtools) in Fedora (GitHub Advisory, Red Hat Bugzilla).