CVE-2026-31966: 
NixOS vulnerability analysis and mitigation

CVE-2026-31966 is an out-of-bounds read vulnerability in HTSlib, a C library for reading and writing bioinformatics file formats (BAM, CRAM, VCF, etc.). The flaw exists in the CRAM decoder's cram_decode_seq() function, which fails to sufficiently validate feature data series when decoding CRAM-format alignment records, allowing memory outside the intended reference buffer to be read and leaked. Affected versions include all HTSlib releases up to and including 1.21, 1.22, 1.22.1, and 1.23. The vulnerability was disclosed on March 18, 2026, with fixes released the same day. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-129 (Improper Validation of Array Index). When HTSlib decodes CRAM records, the reference sequence is stored in a char array and portions are copied into the output sequence buffer or the SAM MD tag buffer. The cram_decode_seq() function failed to properly validate array indices derived from the CRAM feature data series — specifically, off-by-one errors in bounds checks for the BB and BA data series, missing checks for negative-length D/H/P/N features, and missing validation that records do not start before the current reference segment. This allowed crafted CRAM files to cause the function to read memory before the start or after the end of the reference buffer. The fixes applied in commits 4a5ef25, 22ec523, and 2a45eb1 add proper boundary checks and reject malformed records early (GitHub Advisory, Patch commit 22ec523, Patch commit 2a45eb1, Patch commit 4a5ef25).

Successful exploitation allows an attacker to leak arbitrary data from program memory to the calling function, potentially exposing sensitive information about program state, memory layout, or other in-memory data processed by the bioinformatics pipeline. Additionally, the out-of-bounds read can trigger access to invalid memory regions, causing the application to crash and resulting in a denial of service condition. No integrity impact is expected, and there is no evidence of lateral movement capability; however, memory disclosure could facilitate further exploitation in complex pipeline environments (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires no authentication, no user interaction, and no special privileges — a network-accessible attacker can trigger it by supplying a maliciously crafted CRAM file to any system running a vulnerable HTSlib version. The EPSS score is approximately 0.014% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify systems or services that accept CRAM-format files and use HTSlib versions ≤ 1.21, 1.22, 1.22.1, or 1.23 for processing (e.g., bioinformatics web services, genomics pipelines accepting user-uploaded files).
2. Craft malicious CRAM file: Create a CRAM file with specially crafted feature data series — for example, setting feature positions or lengths (D/H/P/N features) to negative values, or encoding alignment positions that place the record before the reference segment start or beyond ref_end, to bypass the insufficient bounds checks in cram_decode_seq().
3. Submit the file: Upload or transmit the malicious CRAM file to the target system through any available input channel (file upload API, pipeline input, shared storage).
4. Trigger out-of-bounds read: When HTSlib processes the file, cram_decode_seq() copies data from outside the intended reference buffer into the output sequence buffer or SAM MD tag buffer, leaking adjacent memory contents to the caller.
5. Collect leaked data or observe crash: Retrieve the output (e.g., decoded sequence data or MD tag) to extract leaked memory contents, or observe a crash/error indicating successful triggering of the invalid memory access (GitHub Advisory, Patch commit 22ec523).

• File System: Presence of unexpected or externally sourced CRAM files submitted to bioinformatics pipelines; CRAM files with anomalous feature data (e.g., negative-length D/H/P/N features, alignment positions outside reference bounds).
• Logs: Application or pipeline logs showing errors or warnings from HTSlib during CRAM decoding, such as unexpected termination, segmentation faults, or error messages referencing cram_decode_seq; repeated processing failures on the same input file.
• Process: Unexpected crashes or core dumps of processes linked against HTSlib (e.g., samtools, bcftools, custom bioinformatics tools); abnormal process exits with signal 11 (SIGSEGV) or signal 6 (SIGABRT) when processing CRAM files.
• Network: Unusual or repeated submission of CRAM files from external or untrusted sources to network-accessible genomics services.

Upgrade HTSlib to one of the patched versions: 1.21.1, 1.22.2, or 1.23.1. There is no workaround available for this vulnerability — the only remediation is to apply the patch. As an interim measure, organizations should restrict CRAM file processing to trusted sources only and consider isolating systems that process untrusted CRAM files from sensitive infrastructure until the update is applied (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was assigned a "Moderate" severity rating by the HTSlib maintainers (GitHub Security Advisory GHSA-5cj8-mj52-8vp3), despite the high CVSS v3.1 score, reflecting the specialized context of bioinformatics pipelines. Red Hat tracked the issue via Bugzilla with a medium priority/severity classification. The oss-security mailing list carried a disclosure notice shortly after publication. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified (GitHub Advisory, Red Hat CVE, oss-security).