CVE-2026-31970: 
NixOS vulnerability analysis and mitigation

CVE-2026-31970 is a heap buffer overflow vulnerability in HTSlib, a widely used C library for reading and writing bioinformatics file formats (e.g., BAM, CRAM, VCF). The flaw exists in the GZI loading function bgzf_index_load_hfile(), where an integer overflow can cause an under- or zero-sized heap buffer to be allocated when processing a crafted .gzi index file. Affected versions include HTSlib ≤ 1.21, 1.22, 1.22.1, and 1.23; patched versions are 1.21.1, 1.22.2, and 1.23.1. The vulnerability was reported by Harrison Green, disclosed publicly on March 18, 2026, and carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, oss-security).

The root cause is an integer overflow (CWE-190) in bgzf_index_load_hfile(), which reads a 64-bit item count from the input .gzi file and uses it to calculate the size of a heap buffer allocation via malloc(moffs * sizeof(bgzidx1_t)). A crafted large value for this count can overflow the multiplication, resulting in a zero- or under-sized allocation (CWE-131). Sixteen zero bytes are then unconditionally written to this buffer (CWE-787, CWE-122), and depending on the overflow result, additional file data may also be loaded into the undersized buffer, causing a heap buffer overflow. The fix, committed as 6dd0d7d, adds an explicit bounds check ensuring the item count does not exceed SIZE_MAX / sizeof(bgzidx1_t) / 2 before proceeding with allocation (GitHub Commit, GitHub Advisory). Exploitation requires user interaction — specifically, a user must open a maliciously crafted .gzi file.

Successful exploitation can cause the affected application to crash (denial of service) or corrupt heap structures in unpredictable ways, potentially enabling arbitrary code execution in the context of the process using HTSlib. The integrity impact is rated High, as heap metadata and application data can be overwritten; availability is also impacted through application crashes. While no confidentiality impact is currently assessed, arbitrary code execution — if achieved — could expose sensitive genomic or research data processed by the affected application (GitHub Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.043%, reflecting a low near-term exploitation probability. Exploitation requires user interaction (passive — a user must open a crafted file), which reduces the likelihood of mass exploitation compared to fully remote, unauthenticated vulnerabilities (GitHub Advisory).

1. Craft a malicious .gzi file: Create a .gzi index file with a manipulated 64-bit item count field set to a value that, when incremented by 1 and multiplied by sizeof(bgzidx1_t) (16 bytes), overflows the target integer type, resulting in a near-zero or zero allocation size.
2. Deliver the file to the target: Distribute the crafted .gzi file via a shared research data repository, email attachment, or any channel where a bioinformatics user would receive index files alongside BGZF-compressed genomic data files.
3. Trigger file loading: Induce the target user to open the associated BGZF file (e.g., a .bam or .bcf file) with a tool that uses HTSlib (such as samtools, bcftools, or a custom application), causing bgzf_index_load_hfile() to parse the malicious .gzi index.
4. Trigger integer overflow and heap corruption: The oversized item count causes malloc() to allocate a near-zero buffer; 16 zero bytes are written to it, and additional file data may be loaded, overflowing the heap buffer and corrupting adjacent heap structures.
5. Achieve crash or code execution: Depending on heap layout and platform, the overflow may crash the application or, with further heap-shaping techniques, potentially redirect execution flow to attacker-controlled code (GitHub Advisory, GitHub Commit).

• File System: Presence of unexpected or externally sourced .gzi index files alongside BGZF-compressed genomic data files (.bam.gzi, .bcf.gzi, etc.) from untrusted origins; .gzi files with anomalously large file sizes inconsistent with the associated data file.
• Process: Unexpected crashes or segmentation faults in HTSlib-based applications (e.g., samtools, bcftools) when opening BGZF-compressed files with associated index files; core dump files generated by these processes.
• Logs: Application error logs showing memory allocation failures, heap corruption errors, or abnormal termination signals (SIGSEGV, SIGABRT) originating from bgzf_index_load_hfile() or related HTSlib functions.

Upgrade HTSlib to the patched versions: 1.21.1 (for the 1.21.x branch), 1.22.2 (for the 1.22.x branch), or 1.23.1 (for the 1.23 branch). As an immediate workaround, discard any .gzi index files received from untrusted sources and regenerate them locally using the bgzip -r <file> command, which ensures the index is derived from a trusted source. Organizations should also implement controls to restrict the ingestion of externally sourced .gzi files in pipelines or applications that use HTSlib (GitHub Advisory, oss-security, Red Hat Bugzilla).

The vulnerability was disclosed by the SAMtools team (Robert Davies) via the oss-security mailing list on March 18, 2026, crediting Harrison Green for the report (oss-security). Red Hat tracked the issue via Bugzilla (Bug 2448777) and assigned it a high severity rating (Red Hat Bugzilla). Community reaction has been measured, consistent with a library-level vulnerability requiring user interaction with no active exploitation observed.