CVE-2026-31966

A flaw was found in htslib, a library for reading and writing bioinformatics file formats. Specifically, within the CRAM Compressed Reference-oriented Alignment Map decoding process, insufficient validation of feature data series could allow a remote attacker to craft malicious CRAM records. This...

UBUNTU-CVE-2026-31966

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it...

CVE-2026-31966

HTSlib CVE-2026-31966 affects the CRAM reader where cram_decode_seq() may copy data from before the start or after the end of the reference due to insufficient validation of the feature data series. This can leak arbitrary data to the caller and may crash the program by accessing invalid memory. ...