CVE-2026-31965: 
NixOS vulnerability analysis and mitigation

CVE-2026-31965 is an out-of-bounds read vulnerability in HTSlib's CRAM file decoder that can lead to information disclosure or denial of service. It affects HTSlib versions up to and including 1.21, 1.22, 1.22.1, and 1.23 — the compressed bioinformatics file format library maintained by the Samtools project. The vulnerability was disclosed on March 18, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of array indices (CWE-129) combined with an out-of-bounds read (CWE-125) in the cram_decode_slice() function within cram/cram_decode.c. When reading CRAM records, the ref_id and mate_ref_id fields decoded from the RI and NS data series were not validated against the valid reference ID range (-1 to bfd->nref - 1) before being used as array indices, allowing two out-of-bounds memory reads to occur before the invalid data was detected and an error reported. The fix, committed as 9cefb46, adds explicit bounds checks for both cr->ref_id and cr->mate_ref_id immediately after decoding, aborting processing if either falls outside the valid range (GitHub Commit, GitHub Advisory). Exploitation requires supplying a malformed CRAM file with crafted reference ID values to an application using a vulnerable HTSlib version.

Successful exploitation can result in two memory values being leaked to the caller (limited confidentiality impact), potentially exposing sensitive in-memory data from bioinformatics processing pipelines. Additionally, the application may crash when attempting to access invalid memory, causing a denial of service that could disrupt genomic data analysis workflows. While the error reporting mechanism makes reliable exploitation of the information disclosure component difficult, the availability impact from crashes is more straightforward to trigger with a malformed CRAM file (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.042%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement to supply a specially crafted CRAM file to a vulnerable application, combined with the error-reporting behavior that limits reliable data leakage, reduces the practical exploitability of this issue.

1. Craft a malicious CRAM file: Create a CRAM-format file with a manipulated RI (reference ID) or NS (mate reference ID) data series field containing a value outside the valid range (i.e., less than -1 or greater than or equal to the number of references in the file header).
2. Deliver the file to a vulnerable application: Supply the malformed CRAM file as input to any application or pipeline that uses HTSlib versions ≤ 1.21, 1.22, 1.22.1, or 1.23 to read CRAM records (e.g., samtools, bcftools, or custom bioinformatics tools).
3. Trigger the out-of-bounds read: When the application calls cram_decode_slice() to process the CRAM records, the unvalidated ref_id or mate_ref_id value is used as an array index before bounds checking occurs, causing two out-of-bounds memory reads.
4. Observe the outcome: The application either crashes (denial of service) due to accessing invalid memory, or — in some execution environments — leaks two memory values to the caller before the function reports an error and aborts (GitHub Advisory, GitHub Commit).

• Logs: Application error logs containing messages such as Requested unknown reference ID <N> or Requested unknown mate reference ID <N> from HTSlib's hts_log_error output, which are emitted by the patched code path and may indicate attempted exploitation even on patched systems.
• Process: Unexpected crashes or segmentation faults in processes that read CRAM files (e.g., samtools, bcftools, or custom tools linked against HTSlib), particularly when processing externally supplied or untrusted CRAM files.
• File System: Presence of anomalous or malformed CRAM files in input directories, especially those with reference ID fields set to extreme values (very large positive integers or values below -1) that would not appear in legitimate genomic data.

Upgrade HTSlib to one of the patched versions: 1.21.1, 1.22.2, or 1.23.1, depending on the currently installed branch. There is no configuration-based workaround available for this vulnerability — patching is the only remediation. Organizations should prioritize upgrading systems that process CRAM files from untrusted or external sources, and consider sandboxing file-processing operations as a defense-in-depth measure (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by HTSlib maintainer daviesrob via a GitHub Security Advisory on March 18, 2026, with an accompanying fix commit. Red Hat tracked the issue via Bugzilla (Bug 2448751) and classified it as medium severity. The disclosure was also noted on the oss-security mailing list and picked up by security aggregators including Tenable (Nessus plugin 302951) and INCIBE-CERT. Community coverage was limited, consistent with the specialized, domain-specific nature of the affected library (GitHub Advisory, Red Hat Bugzilla).