CVE-2026-31966 is a critical memory safety flaw in HTSlib, the bioinformatics library behind samtools, scored 9.1. Weak validation in the CRAM decoder lets a crafted file copy data from outside the reference buffer. Upgrade to HTSlib 1.21.1, 1.22.2 or 1.23.1.
What's affected
HTSlib 1.21 and earlier, plus 1.22, 1.22.1 and 1.23, per the advisory. The patched versions are 1.21.1, 1.22.2 and 1.23.1, one for each maintained line.
The bug is in reading CRAM files, the compressed alignment format. It is not reached by tools that never open CRAM input.
How to check if you're exposed
HTSlib ships on its own and inside other tools, so check both. If the command line tools are installed:
htsfile --version
samtools --version
Both print the HTSlib version they were built with. For containers and conda or distribution packages, read the package version and compare it with the fixed releases. Pipelines that run CRAM files from outside sources are the ones that matter most.
What to do now
- Upgrade to HTSlib 1.21.1, 1.22.2 or 1.23.1, matching the line you use.
- Rebuild or update tools that bundle HTSlib, and container images that include samtools or related software.
- Do not process CRAM files from untrusted sources with unpatched versions.
- Note that the advisory says there is no workaround.
Why it matters
The record lists CWE-125, out-of-bounds read, and CWE-129, improper validation of an array index. The decoder trusted feature data inside the file, which describes differences from a reference sequence. Crafted values made it copy from before the start or after the end of the stored reference.
The advisory says this may leak information about program state and may crash the program. The data copied can end up in output, which is why an outside reader could receive memory contents.
Genomics pipelines often ingest files from collaborators and public archives, so file parsers deserve the same attention as network services.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The advisory says no. Upgrade to a patched release.
Does it affect other formats such as BAM?
The advisory describes the CRAM decoder only.
Sources
Last reviewed: 19 October 2026.
