CVE-2026-31972: 
NixOS vulnerability analysis and mitigation

CVE-2026-31972 is a use-after-free vulnerability in the mpileup command of SAMtools, a widely used bioinformatics toolkit for reading, manipulating, and writing genomic file formats. Under certain conditions, reference sequence data is discarded (freed) prematurely during pileup output processing, leading to a subsequent read from a freed memory pointer. All SAMtools versions up to and including 1.21 are affected; the issue is fixed in versions 1.21.1 and 1.22. It was publicly disclosed on March 18, 2026, by the SAMtools team via GitHub Security Advisories and the oss-security mailing list. The CVSS v4.0 base score is 6.9 (Medium), while an NVD CVSS v3.1 score of 9.8 (Critical) has also been assigned (GitHub Advisory, Red Hat Bugzilla, oss-security).

The root cause is a use-after-free (CWE-416) combined with an expired pointer dereference (CWE-825) in the mplp_get_ref() function within bam_plcmd.c. The mpileup command cached only two in-flight reference sequences, but the pileup logic actually requires up to three simultaneously — the current reference, the previous reference (needed when the -a flag is used to output all positions), and potentially the next reference used by bam_mplp64_auto. When a third reference was needed, the oldest cached reference was freed too early; if that freed reference was subsequently accessed, the program read from an invalid (freed) memory location. The fix, committed as 3036eb9, expands the reference cache from 2 to 3 slots with improved cache management logic (GitHub Advisory, GitHub Commit).

Successful exploitation can result in two primary consequences: leakage of internal program state (memory contents) that could expose sensitive bioinformatics data, and a program crash due to invalid memory access, causing denial of service. In bioinformatics pipeline contexts, leaked memory may contain genomic sequence data or file path information processed by the tool. The CVSS v4.0 scoring reflects low confidentiality and low availability impact on the vulnerable system, with no integrity impact (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The bug is triggered under specific conditions involving multiple reference sequences and use of the -a flag, which may limit opportunistic exploitation (oss-security).

The only remediation is to upgrade SAMtools to version 1.21.1 or 1.22, both of which contain the fix. The SAMtools team has explicitly stated there is no workaround for this issue. Organizations running SAMtools in automated bioinformatics pipelines or as a network-accessible service should prioritize patching, particularly if the mpileup command is used with multiple reference sequences or the -a flag (GitHub Advisory, oss-security).

The vulnerability was disclosed directly by the SAMtools development team (Wellcome Sanger Institute) via the oss-security mailing list and GitHub Security Advisories on March 18, 2026. Red Hat tracked the issue via Bugzilla (Bug 2448857) and classified it as medium severity. Coverage appeared on vulnerability aggregation platforms including VulDB, cvefeed.io, and Tenable (Nessus plugin 303033), as well as the German pro-linux.de security news site (oss-security, Red Hat Bugzilla).