The vulnerability is a heap buffer overflow in the cram_decode_seq function of HTSlib, triggered when improperly handling CRAM records that omit sequence data. The overflow allows an attacker‑controlled byte to be written beyond the bounds of a heap allocation, potentially corrupting memory and enabling arbitrary code execution. The weakness corresponds to several CWE identifiers, including CWE‑122, CWE‑125, CWE‑1284, CWE‑129, and CWE‑787.

Affected systems are the HTSlib library used by samtools. Vulnerable releases include all versions of htslib older than the patch commits, specifically those preceding version 1.23.1, except for releases that were subsequently fixed such as 1.22.2 and 1.21.1. Administrators should verify the installed htslib version against the advisory to determine whether a patch is required.

The severity of the flaw is high with a CVSS score of 8.8, but its EPSS score is less than 1% and it is not listed in the CISA KEV catalog, indicating a lower likelihood of exploitation in the wild. Exploitation requires an attacker to supply a malicious CRAM file that the application processes, meaning the attack vector is local or remote file ingestion. If successful, the defect can lead to program termination or memory corruption that could be leveraged for arbitrary code execution, thus representing a significant security risk when untrusted data is processed.