Skip to main content
VulnerabilityPublished Updated

Htslib: Heap-buffer-overflow

Affects htslibSource GCVE Database

0
Severity
High

Rated High by Threat Radar's AI analysis

Patch
Available – fixed in ae5f79dd51cd296195293690b6f59f0b982ae877, 711871ab53f8133115dceed997d11f481c024e0a

Data as of 12 Nov 2026, 15:36 UTC

What to do

Upgrade htslib to ae5f79dd51cd296195293690b6f59f0b982ae877 or 711871ab53f8133115dceed997d11f481c024e0a.

Affected software

ProductAffectedFixed in
OSS-Fuzzhtslibpkg:generic/htslibOther threatsAffected
  • >=843ca7f53fad9538fe46df2c9d5a503b6b7afbaa <711871ab53f8133115dceed997d11f481c024e0a
  • <ae5f79dd51cd296195293690b6f59f0b982ae877
  • >=6ff2e25c36e82fd9194702270bca322d321e1397
Fixed in
  • 711871ab53f8133115dceed997d11f481c024e0a
  • ae5f79dd51cd296195293690b6f59f0b982ae877

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and has been committed to the htslib codebase. Users should upgrade to a fixed version that includes the commits ae5f79dd51cd296195293690b6f59f0b982ae877 or 711871ab53f8133115dceed997d11f481c024e0a to remediate this vulnerability.

Description

A heap-buffer-overflow vulnerability exists in the cram_encode_container function of htslib. This issue was reported by OSS-Fuzz and involves reading beyond allocated heap memory during CRAM container encoding. Multiple versions of htslib from 1.21.1 through 1.25 are affected. Fixes have been committed to the codebase.

References

Community reviews

Loading reviews…