CVE-2026-31967 is a critical memory safety flaw in HTSlib, scored 9.1. The mate reference id field in CRAM records was not validated, so later lookups could read out of bounds. Upgrade to HTSlib 1.21.1, 1.22.2 or 1.23.1. One upgrade covers it and a related fix.
What's affected
HTSlib 1.21 and earlier, 1.22, 1.22.1 and 1.23. Patched in 1.21.1, 1.22.2 and 1.23.1. The advisory says there is no workaround.
It was fixed in the same releases as CVE-2026-31966, so one upgrade covers both.
How to check if you're exposed
HTSlib ships on its own and inside other tools, so check both. If the command line tools are installed:
htsfile --version
samtools --version
Both print the HTSlib version they were built with. For containers and conda or distribution packages, read the package version and compare it with the fixed releases. Pipelines that run CRAM files from outside sources are the ones that matter most.
What to do now
- Upgrade to HTSlib 1.21.1, 1.22.2 or 1.23.1.
- Update tools and container images that bundle HTSlib.
- Treat CRAM files from outside your organization as untrusted until you have patched.
Why it matters
The class is CWE-125 with CWE-129. The reference id from the file indexes an array of reference names. With no range check, a bad value reads outside the array, and if the byte pattern found there happens to look like a pointer, the program may try to write it as text into the SAM output.
The advisory says information about program state could leak, and the program could crash. Because the effect is an unexpected read rather than a controlled write, the practical risk is data exposure or denial of service in pipelines that process files you do not control.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
How is this related to CVE-2026-31966?
Both are in the CRAM reader and share the same fixed releases. This one concerns the mate reference id, the other the reference feature data.
Sources
Last reviewed: 19 October 2026.
