CVE-2026-31971: 
NixOS vulnerability analysis and mitigation

CVE-2026-31971 is a buffer overflow vulnerability in HTSlib's CRAM file decoder that can result in heap-based or stack-based buffer overflows with attacker-controlled bytes. It affects HTSlib versions up to and including 1.21, 1.22, 1.22.1, and 1.23. The vulnerability was published on March 18, 2026, by the samtools/htslib project maintainers. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause lies in the cram_byte_array_len_decode() function within HTSlib's CRAM decoder, which failed to validate that the amount of data being unpacked via the BYTE_ARRAY_LEN encoding method matched the size of the destination output buffer (CWE-121, CWE-122, CWE-787, CWE-1284, CWE-131). Specifically, the length field decoded by len_codec->decode() was not checked against *out_size before being used to drive the subsequent value decode operation, allowing an attacker-crafted CRAM file to write beyond the bounds of either a heap or stack buffer. The fix, committed as 01cd003, adds an explicit bounds check — rejecting any decoded length that exceeds *out_size — and corrects how out_sz is scaled for auxiliary tag types before calling the decoder (GitHub Commit, GitHub Advisory). Exploitation requires a user to open a specially crafted CRAM file, making it a file-parsing attack vector.

Successful exploitation can lead to program crashes (denial of service), corruption of heap or stack data structures in ways unintended by the program, alteration of control flow, and potentially arbitrary code execution in the context of the user running the affected application. Because CRAM files are commonly processed in bioinformatics pipelines — often in automated or batch workflows — a malicious file introduced into such a pipeline could affect data integrity and system availability. Confidentiality impact is assessed as none in the current scoring, but arbitrary code execution could enable further post-exploitation activity (GitHub Advisory, Red Hat).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0013 (0.13%), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must open a maliciously crafted CRAM file — which reduces the likelihood of mass automated exploitation.

1. Craft a malicious CRAM file: Create a CRAM-format file that encodes a data series using the BYTE_ARRAY_LEN method, where the length field value decoded by cram_byte_array_len_decode() exceeds the actual size of the output buffer allocated by the calling code.
2. Deliver the file to the target: Distribute the crafted CRAM file via email, a shared bioinformatics data repository, a compromised upstream data source, or a network file share accessible to the target user or pipeline.
3. Trigger file parsing: Induce the target user or automated pipeline to open or process the malicious CRAM file using an application linked against a vulnerable version of HTSlib (≤ 1.21, 1.22.x < 1.22.2, or 1.23).
4. Trigger buffer overflow: When cram_byte_array_len_decode() processes the crafted BYTE_ARRAY_LEN-encoded data, the unvalidated length causes the value codec to write attacker-controlled bytes beyond the bounds of the output buffer, overflowing either the heap or stack.
5. Achieve code execution or crash: Depending on the overflow type and memory layout, the attacker may overwrite adjacent data structures or return addresses to redirect control flow and achieve arbitrary code execution, or cause the application to crash (GitHub Advisory, GitHub Commit).

• Process: Unexpected crashes or segmentation faults in applications linked against HTSlib (e.g., samtools, bcftools, custom bioinformatics tools) when processing CRAM files from untrusted or external sources.
• Logs: Application error logs showing messages such as Attempted overrun detected in cram_byte_array_len_decode (present only in patched versions; absence of this message on unpatched systems may indicate silent exploitation).
• File System: Presence of unexpected or externally sourced CRAM files in data processing directories, particularly those with anomalous file sizes or metadata inconsistent with legitimate sequencing output.
• Network: Unusual outbound network connections or spawned child processes originating from bioinformatics pipeline processes after CRAM file ingestion, which could indicate post-exploitation activity.

Upgrade HTSlib to one of the patched versions: 1.21.1, 1.22.2, or 1.23.1, depending on the currently deployed branch. There is no configuration-based workaround available for this vulnerability. As an interim measure, restrict processing of CRAM files to only those from trusted, verified sources, and avoid ingesting CRAM files from untrusted or external parties until patching is complete (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed via the GitHub Security Advisory system by HTSlib maintainer daviesrob on March 18, 2026, and was simultaneously reported to Red Hat's Product Security team via Bugzilla. The oss-security mailing list also carried a notification shortly after disclosure (oss-sec). Coverage appeared on security aggregation sites and Mastodon shortly after publication, but no significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability tracking.