CVE-2026-31962
Description
A flaw was found in htslib, a library for reading and writing bioinformatics file formats. A local user could exploit a heap buffer overflow vulnerability by opening a specially crafted CRAM file. This flaw occurs due to incorrect handling of certain CRAM format records, leading to reading and writing a single byte beyond a heap allocation. Successful exploitation could result in a program crash, data corruption, or potentially arbitrary code execution.
Statement
This is an IMPORTANT heap buffer overflow flaw in the HTSlib CRAM reader. The vulnerability can be triggered when processing a specially crafted CRAM file, potentially leading to application crashes, data corruption, or arbitrary code execution. This issue affects Red Hat Community Projects, including EPEL and Fedora.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
