Threats tagged 'ghsa-r296-8jjg-794r'

HTSlib versions through 1.24 have a heap out-of-bounds read and write vulnerability in the function bgzf_index_load_hfile() located in bgzf.c. This flaw allows an attacker to corrupt heap memory by providing a specially crafted .gzi index entry count. Specifically, a count value of 0xFFFFFFFF causes truncation of an internal variable to zero, leading to writes beyond a zero-sized malloc buffer and an out-of-bounds read in bgzf_useek(). This can result in heap corruption or crashes in dependent tools such as samtools and bcftools.