CVE-2026-31970
Published: 18 March 2026
Summary
CVE-2026-31970 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Htslib Htslib. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the vulnerability by requiring timely remediation through patching HTSlib to fixed versions 1.23.1, 1.22.2, or 1.21.1.
Validates GZI index file inputs, such as record counts and sizes, to prevent integer overflows during buffer allocation in bgzf_index_load_hfile().
Implements memory safeguards to protect against heap buffer overflows that could lead to data overwrite or arbitrary code execution from malformed GZI files.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in file parsing library (GZI index loader) is triggered by a maliciously crafted file requiring user interaction to open, directly enabling client-side exploitation and arbitrary code execution via malicious files.
NVD Description
HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or…
more
zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. The easiest work-around is to discard any `.gzi` index files from untrusted sources, and use the `bgzip -r` option to recreate them.
Deeper analysisAI
CVE-2026-31970 is a heap buffer overflow vulnerability in HTSlib, a C library for high-throughput sequencing data storage used in bioinformatics applications for reading and writing file formats like block-compressed GZIP (BGZF) files. The issue occurs in the GZI index loading function, `bgzf_index_load_hfile()`, where an integer overflow can result in an under- or zero-sized buffer allocation. Subsequent operations write 16 zero bytes to this buffer and may load additional file data, leading to overflow. When the function fails to read the expected records, it attempts to free the overflowed heap buffer. This affects HTSlib versions prior to the fixes in 1.23.1, 1.22.2, and 1.21.1.
Attackers can exploit this vulnerability remotely over a network with low complexity and no privileges required, but it necessitates user interaction, such as opening a maliciously crafted GZI index file paired with a BGZF file. Successful exploitation causes heap buffer overflow, potentially crashing the affected program, overwriting heap data structures, or enabling arbitrary code execution depending on the application's context and memory layout.
The HTSlib security advisory (GHSA-p345-84hx-fq6q) and corresponding patch commit detail fixes in versions 1.23.1, 1.22.2, and 1.21.1. A recommended workaround is to discard GZI index files from untrusted sources and regenerate them using the `bgzip -r` option, as announced in the OSS-security mailing list on 2026-03-18. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) and maps to CWEs 122, 131, 190, 787, and 1284.
Details
- CWE(s)