CVE-2026-31964: 
NixOS vulnerability analysis and mitigation

CVE-2026-31964 is a NULL pointer dereference vulnerability in HTSlib's CRAM decoder affecting the CONST, XPACK, and XRLE encodings. When decoding CRAM records with omitted sequence or quality data, these encodings attempt to write to a NULL pointer, causing a program crash. The vulnerability affects HTSlib versions up to and including 1.21, 1.22, 1.22.1, and 1.23. It was disclosed on March 18, 2026, with fixed versions released simultaneously. The CVSS v3.1 base score is 7.5 (High), and the CVSS v4.0 base score is 6.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The CRAM format allows alignment records to omit sequence or quality data, signaling this condition by passing a NULL output pointer (out == NULL) to the codec's decode function. The CONST, XPACK, and XRLE encodings in cram/cram_codecs.c failed to check for this NULL condition before writing, resulting in an invalid memory write. The fix (commit e64e68d) adds NULL checks in cram_const_decode_byte, cram_xpack_decode_char, and cram_xrle_decode_char before any write operations are performed (GitHub Commit, GitHub Advisory). An attacker can trigger this by supplying a crafted CRAM file using one of the affected encodings with records that omit sequence or quality data.

Successful exploitation results in a denial of service (DoS) through program crash, impacting the availability of bioinformatics applications and pipelines that rely on HTSlib to process CRAM files. There is no confidentiality or integrity impact on the vulnerable system. Pipelines processing untrusted or externally sourced CRAM files are at highest risk, as a single malicious file can disrupt genomic data analysis workflows (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no privileges, no user interaction, and is reachable over the network (e.g., via a web service that accepts CRAM file uploads), making it straightforward to trigger if an attacker can supply a malicious CRAM file. The EPSS score is approximately 0.044%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Craft a malicious CRAM file: Create a CRAM-format file that uses the CONST, XPACK, or XRLE encoding for sequence or quality data, and includes alignment records where sequence or quality values are explicitly omitted (as permitted by the CRAM specification).
2. Identify a target: Locate a system or service running a vulnerable version of HTSlib (≤ 1.21, 1.22, 1.22.1, or 1.23) that processes CRAM files — such as a bioinformatics pipeline, web API, or command-line tool like samtools.
3. Deliver the malicious file: Submit the crafted CRAM file to the target system, either by uploading it to a web service, placing it in a monitored directory, or passing it as input to a vulnerable tool.
4. Trigger the crash: When the application attempts to decode the CRAM records using the affected encoding, it will attempt to write to a NULL pointer, causing a NULL pointer dereference and program crash (denial of service) (GitHub Advisory, GitHub Commit).

• Logs: Unexpected application crashes or segmentation fault (SIGSEGV) entries in system logs (e.g., /var/log/syslog, application-specific logs) associated with HTSlib-based processes.
• Process: Abnormal termination of bioinformatics tools (e.g., samtools, bcftools, or custom HTSlib-linked applications) with exit codes indicating a crash signal.
• File System: Presence of unexpected or externally sourced CRAM files in input directories, particularly files using CONST, XPACK, or XRLE encodings with omitted sequence/quality data.
• Network: Unusual or repeated uploads of CRAM files to services that process genomic data, especially from untrusted or external sources.

Upgrade HTSlib to one of the patched versions: 1.21.1, 1.22.2, or 1.23.1. There is no workaround available for this vulnerability — patching is the only mitigation. Organizations should prioritize upgrading systems that process CRAM files from untrusted or external sources, and downstream packages (e.g., samtools, bcftools) that bundle HTSlib should also be updated (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by HTSlib maintainer daviesrob via a GitHub Security Advisory on March 18, 2026, with patches released simultaneously. Red Hat tracked the issue via Bugzilla (Bug 2448756) and classified it as medium severity. The OSS security mailing list (oss-sec) also carried a disclosure notice. Coverage has been limited to vulnerability aggregators and Linux distribution security channels, with no significant broader media attention (GitHub Advisory, Red Hat Bugzilla).