CVE-2026-31968: 
NixOS vulnerability analysis and mitigation

CVE-2026-31968 is a buffer overflow vulnerability in the HTSlib CRAM decoder, affecting the VARINT and CONST encoding handlers due to incomplete validation of the context in which these encodings are used. It affects HTSlib versions up to and including 1.21, 1.22, 1.22.1, and 1.23. The vulnerability was disclosed on March 18, 2026, by the samtools/htslib maintainers via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Red Hat).

The root cause is incomplete type validation in the CRAM decoder's handling of VARINT and CONST encodings (CWE-121, CWE-122, CWE-787, CWE-843). When a crafted CRAM file specifies these encodings in a context where array (BYTE_ARRAY) output is expected, the decoder fails to reject the incompatible type, allowing up to eight bytes to be written beyond the end of a heap allocation or to the location of a one-byte stack variable. The fix, committed as 0ec4367, adds explicit checks to reject BYTE_ARRAY type outputs for VARINT codecs and enforces strict codec/option pairing for CONST codecs, returning an error for malformed streams (GitHub Commit, GitHub Advisory). Exploitation requires a user to open a specially crafted CRAM file, making this a file-parsing vulnerability triggered via user interaction.

Successful exploitation can result in a heap buffer overflow or stack overflow, leading to program crashes, unexpected overwriting of heap or stack data structures, or redirection of program control flow. In the worst case, an attacker may achieve arbitrary code execution in the context of the user running the affected application. Integrity and availability are the primary impacts; confidentiality is not directly affected according to the CVSS scoring (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024% (0.000240), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a user must open a maliciously crafted CRAM file — which somewhat limits the attack surface compared to fully remote, unauthenticated vectors (GitHub Advisory, Feedly).

1. Craft a malicious CRAM file: Create a CRAM-format bioinformatics file that specifies a VARINT or CONST encoding in a data series context where a BYTE_ARRAY output type is expected, exploiting the missing type validation in the decoder.
2. Deliver the file to the target: Distribute the crafted CRAM file to a target user via email, a shared file system, a bioinformatics data repository, or a web download — any channel through which a researcher or analyst might receive genomic data files.
3. Trigger parsing: Induce the target user to open the file with an application built against a vulnerable version of HTSlib (≤ 1.21, 1.22, 1.22.1, or 1.23), such as samtools, bcftools, or any third-party tool linking HTSlib.
4. Trigger the overflow: The CRAM decoder processes the malformed encoding header, writing up to eight bytes beyond the heap allocation boundary or onto the stack adjacent to a one-byte variable, corrupting memory.
5. Achieve code execution or crash: Depending on memory layout and the specific overflow path (heap or stack), the attacker may redirect control flow to attacker-controlled code, or at minimum cause a denial of service via program crash (GitHub Advisory, GitHub Commit).

• Logs: Application logs showing hts_log_error messages such as "Malformed varint header stream" or "Malformed const header stream" from HTSlib (present only in patched versions; absence of these errors in older versions does not rule out exploitation).
• Process: Unexpected crashes or segmentation faults in processes using HTSlib (e.g., samtools, bcftools) when processing CRAM files from untrusted sources; core dump files generated by these processes.
• File System: Presence of unusual or externally sourced .cram files in working directories, especially those with anomalous encoding headers detectable via CRAM format inspection tools.
• Network: Unexpected outbound connections from bioinformatics analysis hosts following the opening of a CRAM file, which could indicate post-exploitation activity if code execution was achieved.

Upgrade HTSlib to one of the patched versions: 1.23.1, 1.22.2, or 1.21.1, depending on the currently deployed branch. The vendor has confirmed there is no workaround available — patching is the only remediation. Organizations should also audit any downstream tools (e.g., samtools, bcftools, or custom pipelines) that bundle or link against HTSlib and update those packages accordingly (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed by HTSlib maintainer daviesrob via a GitHub Security Advisory on March 18, 2026, and was simultaneously reported to Red Hat's Product Security team via Bugzilla. The oss-security mailing list carried a notification shortly after disclosure (oss-security). Coverage appeared on security aggregation sites and Mastodon within hours of disclosure, and Tenable released a Nessus detection plugin (ID 302952) the following day (Tenable). Community reaction has been measured, consistent with the low EPSS score and absence of active exploitation.