CVE-2026-31972 is a critical use after free in samtools, scored 9.8. The mpileup command can discard reference data too early and then read from the freed memory. Upgrade to samtools 1.21.1 or 1.22, or later. There is no workaround, so patch.
What's affected
samtools 1.21 and earlier, per the advisory. Fixed in 1.21.1 and 1.22. The advisory says there is no workaround.
The bug sits in mpileup, which prints aligned bases per reference position, when it is given reference data from a separate file.
How to check if you're exposed
samtools --version
Compare the printed version with 1.21.1 and 1.22. Check conda environments, container images and workflow managers that pin their own samtools version, since a pipeline may use a copy different from the one on your path.
What to do now
- Upgrade samtools to 1.21.1, 1.22 or later.
- Update pinned samtools versions in pipeline definitions and container images.
- Run mpileup on untrusted input only with the fixed version.
Why it matters
The class is CWE-416, use after free. The program discards reference data once it is no longer needed, and under certain conditions it did so too early. It then tried to read through a pointer to freed memory.
The advisory says this could leak information about program state or crash the program. Bioinformatics tools handle large inputs from many sources, and memory errors in them are easy to overlook because they run in batch jobs.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Does this affect every samtools command?
The advisory describes the mpileup command.
Sources
Last reviewed: 19 October 2026.
