HTSlib through version 1.24 contains a heap out-of-bounds write and read in the bgzf_index_load_hfile() function. A maliciously crafted .gzi index entry count of 0xFFFFFFFF truncates the noffs value to zero, causing writes beyond a malloc(0) buffer and a subsequent unsafely indexed read. This corrupts heap memory or causes application termination in utilities such as samtools and bcftools.

The vulnerable code is part of the htslib library shipped with Samtools. All releases up to and including version 1.24 are affected; newer releases past 1.24 are not known to contain the flaw.

The CVSS score of 4.8 indicates moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to supply a malformed .gzi index file, which can be delivered locally or over a network if tools accept untrusted input. The likely attack vector is a local or network‑based file injection scenario, inferred from the nature of the flaw and the need for a crafted index entry count.