CVE-2026-31969: 
NixOS vulnerability analysis and mitigation

CVE-2026-31969 is a heap buffer overflow vulnerability in HTSlib's CRAM decoder, caused by an out-by-one error in the cram_byte_array_stop_decode_char() function. When reading CRAM-encoded data using the BYTE_ARRAY_STOP method, an incorrect buffer-full check allows a single attacker-controlled byte to be written beyond the end of a heap allocation. Affected versions include all HTSlib releases before 1.21.1, versions 1.22.x before 1.22.2, and version 1.23 (fixed in 1.23.1). The vulnerability was disclosed on March 18, 2026, and carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-122: Heap-based Buffer Overflow; CWE-787: Out-of-bounds Write) in the cram_byte_array_stop_decode_char() function within cram/cram_codecs.c. The original code used term-- < 0 as the boundary check, which triggered one byte too late — allowing a write to occur one byte past the end of the allocated heap buffer before the overflow was detected. The fix, committed as 88cdf69, restructures the loop to use --term >= 0 and defers the stop-byte check until after the loop, correctly handling the edge case where the output buffer is completely filled but the next input character is the stop byte (GitHub Commit, GitHub Advisory). Exploitation requires a user to open a specially crafted CRAM file, making user interaction a prerequisite.

Successful exploitation can cause the affected program to crash (denial of service) or corrupt heap data structures in ways unintended by the program, potentially enabling arbitrary code execution. The integrity impact is rated High, as an attacker can overwrite heap memory with a controlled byte value, while availability is also impacted through potential crashes. Confidentiality is not directly impacted by this vulnerability. Given that HTSlib is widely used in bioinformatics pipelines and tools (e.g., samtools, bcftools), exploitation could affect research workflows and genomic data processing systems (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.076%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must open a maliciously crafted CRAM file — which limits the attack surface compared to fully remote, unauthenticated vulnerabilities.

1. Craft a malicious CRAM file: Create a CRAM-format file that encodes data using the BYTE_ARRAY_STOP method, with the encoded byte array sized to exactly fill the target output buffer, placing a controlled byte value at the position that will be written one byte past the buffer boundary.
2. Deliver the file to the target: Distribute the crafted CRAM file via email attachment, shared storage, public data repositories, or any channel where a bioinformatics analyst would open genomic data files.
3. Trigger parsing: The victim opens the file using an HTSlib-based tool (e.g., samtools view, bcftools, or a custom application linking HTSlib versions ≤1.21, 1.22.x <1.22.2, or 1.23).
4. Heap overflow occurs: The cram_byte_array_stop_decode_char() function writes one attacker-controlled byte beyond the heap allocation due to the off-by-one boundary check error.
5. Achieve objective: Depending on heap layout and the value of the overwritten byte, the outcome may be a program crash (DoS) or, with careful heap grooming, corruption of adjacent heap metadata or function pointers to achieve arbitrary code execution (GitHub Advisory, GitHub Commit).

• Process: Unexpected crashes or segmentation faults in HTSlib-based tools (e.g., samtools, bcftools) when processing CRAM files, particularly with core dumps referencing cram_byte_array_stop_decode_char in the stack trace.
• Logs: Application error logs showing heap corruption errors, abort signals, or memory sanitizer reports (e.g., AddressSanitizer output indicating heap-buffer-overflow in cram_codecs.c) when opening specific CRAM files.
• File System: Presence of unexpected or externally sourced CRAM files in data directories, especially files with unusual sizes or metadata inconsistent with legitimate genomic datasets.
• Network: Unusual download activity of CRAM files from untrusted or external sources into bioinformatics pipeline input directories.

Upgrade HTSlib to one of the patched versions: 1.21.1 (for the 1.21.x branch), 1.22.2 (for the 1.22.x branch), or 1.23.1 (for the 1.23.x branch). There is no available workaround — patching is the only effective remediation. Organizations should also audit any downstream tools or pipelines that bundle HTSlib (e.g., samtools, bcftools, bioinformatics frameworks) and update those as well (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported via Red Hat's security tracking system and published through GitHub's security advisory mechanism by HTSlib maintainer daviesrob. The oss-security mailing list carried a disclosure notice shortly after publication (oss-sec). Tenable published a Nessus detection plugin (ID 302953) for the vulnerability. Community coverage has been limited, consistent with the specialized bioinformatics audience of the affected library.