CVE-2026-31963

A flaw was found in HTSlib, a library for reading and writing bioinformatics file formats. When processing CRAM Compressed Reference-oriented Alignment Map files, an out-by-one error in feature decoding can cause a heap buffer overflow. This vulnerability allows an attacker to craft a malicious...

CVE-2026-31963

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it...

CVE-2026-31963

HTSlib CRAM reader vulnerability (CVE-2026-31963) arises from an out-by-one error when decoding CRAM features that extend beyond the record boundary. This can write one attacker-controlled byte past the end of a heap buffer, causing a heap buffer overflow. The issue may crash the program, overwri...

CVE-2026-31963: Heap-based Buffer Overflow

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. As one method of removing redundant data, CRAM uses reference-based compression so that instead of storing the full sequence for each alignment record it...