CVE-2026-31967: 
NixOS vulnerability analysis and mitigation

CVE-2026-31967 is an out-of-bounds read vulnerability in HTSlib, a C library for reading and writing bioinformatics file formats, caused by improper validation of the mate reference ID field when decoding CRAM records. The flaw exists in the cram_decode_slice() function and affects HTSlib versions up to and including 1.21, 1.22, 1.22.1, and 1.23. Fixed versions are 1.21.1, 1.22.2, and 1.23.1, published on March 18, 2026 (GitHub Advisory). The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper validation of array index (CWE-129) combined with an out-of-bounds read (CWE-125) in the cram_decode_slice() function within cram/cram_decode.c. When reading CRAM records, the mate_ref_id field decoded from the DS_NS data series is used without bounds checking against the valid reference ID range (-1 to bfd->nref - 1), allowing an attacker-controlled value to index outside the reference name array. If the out-of-bounds memory location happens to contain a valid pointer, it is interpreted as a string and written into the SAM output record, potentially leaking program memory contents. The fix (commit 9cefb46) adds explicit range checks for both ref_id and mate_ref_id before use, rejecting values outside the valid range (GitHub Commit, GitHub Advisory).

Successful exploitation can result in information disclosure of program state — including potential leakage of memory addresses or data via SAM output — and denial of service through application crashes caused by invalid memory access. The vulnerability requires no authentication or user interaction and is reachable over the network in applications that expose CRAM file processing remotely, broadening the attack surface to bioinformatics pipelines and genomics platforms. Integrity is not directly impacted, but confidentiality and availability are both affected (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious CRAM file: Create a CRAM file containing a record where the mate reference ID field (mate_ref_id, encoded in the DS_NS data series) is set to an out-of-range value — either a large positive integer exceeding the number of references (bfd->nref) or another invalid value not equal to -1.
2. Deliver the file to a vulnerable application: Submit the crafted CRAM file to a network-accessible service or application that uses a vulnerable version of HTSlib (≤ 1.21, 1.22, 1.22.1, or 1.23) to process CRAM input, such as a genomics data pipeline or web-based alignment viewer.
3. Trigger CRAM decoding: Cause the application to invoke cram_decode_slice() on the malicious file, which reads the unvalidated mate_ref_id without bounds checking.
4. Achieve out-of-bounds read: The invalid mate_ref_id is used to index the reference name array out of bounds. If the memory at that location contains a valid pointer, it is treated as a string.
5. Observe information disclosure or crash: The out-of-bounds string is written into the SAM output record (information disclosure), or the application crashes when attempting to access an invalid memory address (denial of service) (GitHub Advisory, GitHub Commit).

• Logs: Application error logs containing messages such as Requested unknown mate reference ID <N> or Requested unknown reference ID <N> from HTSlib's hts_log_error (present in patched versions; absence of these in unpatched versions may indicate silent exploitation).
• Application Behavior: Unexpected crashes or segmentation faults in processes using HTSlib when processing CRAM files, particularly during SAM format conversion.
• File System: Presence of anomalous or externally sourced CRAM files in input directories of bioinformatics pipelines, especially files with unusual or malformed headers.
• Network: Unexpected or large SAM output records containing non-reference string data, which may indicate memory content leakage embedded in output (GitHub Advisory).

Upgrade HTSlib to one of the patched versions: 1.21.1, 1.22.2, or 1.23.1, depending on the version branch in use. There is no configuration-based workaround available for this vulnerability. As an interim measure, restrict processing of CRAM files to trusted sources only, and limit network exposure of applications that use HTSlib for CRAM parsing (GitHub Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their security advisory and Bugzilla system, classifying it as medium severity (Red Hat Advisory). The vulnerability was disclosed by HTSlib maintainer daviesrob via a GitHub Security Advisory on March 18, 2026, with a coordinated patch release. The oss-security mailing list also carried a notification (oss-sec). No significant broader media coverage or notable community controversy has been observed.