CVE-2026-31973: 
NixOS vulnerability analysis and mitigation

CVE-2026-31973 is a NULL pointer dereference vulnerability in SAMtools, a widely used bioinformatics toolkit for reading, manipulating, and writing genomic file formats. The flaw exists in the cram-size command, which is used to report compression statistics for CRAM files. Introduced in version 1.17, the vulnerability stems from a missing return-value check on the cram_decode_compression_header() function; if that function fails, the program proceeds to dereference a NULL pointer. Affected versions include 1.17 through 1.21, 1.22, 1.22.1, and 1.23; fixed versions are 1.21.1, 1.22.2, and 1.23.1. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In cram_size.c, the cram_decode_compression_header() function can return NULL on error (e.g., when processing a malformed CRAM file), but the original code did not check this return value before using the pointer, leading directly to a crash. The fix (commit 06fc2a2) adds an explicit NULL check after the call and ensures proper cleanup of the compression header and hash table in error paths, as well as closing the input hFILE on failure in main_cram_size(). The attack vector is network-based (AV:N), requires no authentication or user interaction, and can be triggered by supplying a crafted malformed CRAM file to the cram-size command (GitHub Commit, GitHub Advisory).

Successful exploitation causes SAMtools to crash via a NULL pointer dereference, resulting in a denial of service (DoS) of any pipeline or service relying on the cram-size command. There is no confidentiality impact, and integrity impact is assessed as low (CVSS v4.0). The primary risk is disruption to bioinformatics processing pipelines — particularly in research or clinical environments where automated CRAM file analysis is performed — if an attacker can supply malformed input files (GitHub Advisory, oss-security).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. Despite requiring no authentication or user interaction, exploitation is limited to denial-of-service and depends on an attacker being able to supply a malformed CRAM file to the affected command (GitHub Advisory, oss-security).

1. Identify target: Locate a system or service running SAMtools versions 1.17–1.21, 1.22, 1.22.1, or 1.23 that processes CRAM files via the cram-size command, particularly any pipeline that accepts externally supplied CRAM files.
2. Craft malformed CRAM file: Create a CRAM file with a corrupted or invalid compression header block that causes cram_decode_compression_header() to return NULL when parsed.
3. Deliver the malformed file: Submit the crafted CRAM file to the target system — for example, by uploading it to a file-processing endpoint, placing it in a monitored input directory, or passing it directly as a command-line argument if the attacker has shell access.
4. Trigger the crash: The cram-size command processes the file, cram_decode_compression_header() returns NULL, and the unguarded dereference causes a segmentation fault, crashing the SAMtools process and disrupting the pipeline (GitHub Advisory, GitHub Commit).

• Logs: Segmentation fault or crash messages in system logs (e.g., dmesg, syslog, or application logs) referencing the samtools or cram_size process; core dump files generated by the SAMtools process.
• File System: Unexpected or malformed .cram files appearing in input directories monitored by automated pipelines; core dump files (e.g., core, core.<pid>) in the SAMtools working directory.
• Process: Repeated abnormal termination of the samtools process with exit code indicating a signal (e.g., SIGSEGV / signal 11); pipeline jobs failing repeatedly when processing specific CRAM files.

Upgrade SAMtools to one of the patched versions based on your current installation: 1.21.1 (for versions 1.17–1.21), 1.22.2 (for versions 1.22–1.22.1), or 1.23.1 (for version 1.23). There is no configuration-based workaround available for this vulnerability. As an interim measure, restrict the cram-size command to processing only trusted, internally generated CRAM files and avoid exposing CRAM file processing pipelines to untrusted external input (GitHub Advisory, oss-security).

The vulnerability was disclosed by the SAMtools team (Robert Davies, Wellcome Sanger Institute) via the oss-security mailing list on March 18, 2026, alongside the GitHub Security Advisory (oss-security). Red Hat tracked the issue via Bugzilla and assessed it as medium severity (Red Hat Bugzilla). Community reaction has been limited, consistent with the moderate severity and narrow impact scope of the vulnerability; no significant controversy or widespread media coverage has been observed.