Cyber Resilience

CVE-2026-31970

Memory Safety in Htslib ≤ 1.21

Published
18 March 2026
Modified
19 March 2026
Patch / advisory
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0045 37th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-31970 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Htslib Htslib. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-31970 is a heap buffer overflow vulnerability in HTSlib, a C library for high-throughput sequencing data storage used in bioinformatics applications for reading and writing file formats like block-compressed GZIP (BGZF) files. The issue occurs in the GZI index loading function, `bgzf_index_load_hfile()`, where an integer overflow can result in an under- or zero-sized buffer allocation. Subsequent operations write 16 zero bytes to this buffer and may load additional file data, leading to overflow. When the function fails to read the expected records, it attempts to free the overflowed heap buffer. This affects HTSlib versions prior to the fixes in 1.23.1, 1.22.2, and 1.21.1.

Attackers can exploit this vulnerability remotely over a network with low complexity and no privileges required, but it necessitates user interaction, such as opening a maliciously crafted GZI index file paired with a BGZF file. Successful exploitation causes heap buffer overflow, potentially crashing the affected program, overwriting heap data structures, or enabling arbitrary code execution depending on the application's context and memory layout.

The HTSlib security advisory (GHSA-p345-84hx-fq6q) and corresponding patch commit detail fixes in versions 1.23.1, 1.22.2, and 1.21.1. A recommended workaround is to discard GZI index files from untrusted sources and regenerate them using the `bgzip -r` option, as announced in the OSS-security mailing list on 2026-03-18. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) and maps to CWEs 122, 131, 190, 787, and 1284.

EU & UK References

Vulnerability Data

HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading function, `bgzf_index_load_hfile()`, it was possible to trigger an integer overflow, leading to an under- or…

more

zero-sized buffer being allocated to store the index. Sixteen zero bytes would then be written to this buffer, and, depending on the result of the overflow the rest of the file may also be loaded into the buffer as well. If the function did attempt to load the data, it would eventually fail due to not reading the expected number of records, and then try to free the overflowed heap buffer. Exploiting this bug causes a heap buffer overflow. If a user opens a file crafted to exploit this issue, it could lead to the program crashing, or overwriting of data and heap structures in ways not expected by the program. It may be possible to use this to obtain arbitrary code execution. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. The easiest work-around is to discard any `.gzi` index files from untrusted sources, and use the `bgzip -r` option to recreate them.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1211 Exploitation for Stealth Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-31971Same product: Htslib Htslib
CVE-2026-31969Same product: Htslib Htslib
CVE-2026-31963Same product: Htslib Htslib
CVE-2026-31968Same product: Htslib Htslib
CVE-2026-31962Same product: Htslib Htslib
CVE-2026-2047Shared CWE-122, CWE-131
CVE-2025-57807Shared CWE-122, CWE-131
CVE-2026-26200Shared CWE-122, CWE-131
CVE-2026-4152Shared CWE-122, CWE-131
CVE-2026-23876Shared CWE-122, CWE-190

Affected Assets

htslib
htslib
1.23 · ≤ 1.21 · 1.22 — 1.22.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V6.7.2
  • V1.4.1
  • V1.4.2
  • V2.1.1

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation (including fuzzing and memory-error detectors) can discover heap overflows after they have been coded.

Input validation enforces bounds checking on data written to heap buffers, directly stopping the overflow condition from being introduced.

Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.

Security engineering principles require use of memory-safe constructs and bounds-checked allocation routines that avoid introducing heap overflows.

Memory-protection mechanisms limit the ability of a heap overflow to execute attacker-controlled code or corrupt adjacent structures.

Flaw-remediation processes that include vulnerability scanning or static analysis will surface buffer-size errors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.

PR.PS-02 partial match
prevents

Timely patching removes known heap-overflow instances after they exist.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Secure coding standards directly require correct buffer-size calculations.

finds

Security testing in development and acceptance can detect heap overflows before release.

prevents

Secure development lifecycle mandates practices that reduce the likelihood of introducing heap overflows.

prevents

Application security requirements can specify bounds-checking and safe memory APIs that mitigate heap overflows.

prevents

Secure architecture and engineering principles include memory-safety and input-validation controls that address heap overflows.

prevents

Change management can enforce review gates that catch unsafe memory operations before deployment.

References