HTSlib, a C library for handling bioinformatics file formats, includes a CRAM reader that reconstructs aligned reads from compressed data. During decoding, the implementation checks for CRAM features that exceed the extent of the record sequence. An out‑by‑one error in this boundary test allows a crafted feature to write a single attacker‑controlled byte just past the end of a heap‑allocated buffer. This heap buffer overflow can corrupt adjacent memory, potentially resulting in program crash, data corruption, or, in the most severe cases, arbitrary code execution. The vulnerability is represented by several standard weaknesses: buffer overread (CWE‑122), off‑by‑one error (CWE‑129), signed/unsigned mismatch (CWE‑193), and heap buffer overflow (CWE‑787).

The flaw is present in the htslib component of the samtools project, which is used by a wide range of bioinformatics tools to read and write compressed alignment files. Versions of htslib released prior to the security patch – i.e., any release older than 1.21.1, 1.22.2, or 1.23.1 – are affected. All builds newer than those – such as 1.23.1 and subsequent releases – contain the fix. Systems that process CRAM files with an unpatched htslib instance are therefore at risk.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog, reinforcing that it has not yet been widely exploited. Exploitation requires an attacker to supply a malicious CRAM file that an application will decode. The attack vector is therefore file‑based, usually local if the file is opened manually, or remote if an application receives CRAM data from an untrusted source such as a network service. Because the flaw corrupts heap rather than allowing unrestricted memory read/write, the ultimate impact depends on the target application; the most damaging outcome is presumed to be code execution that could grant an attacker persistence or privilege escalation. Consequently, applying the vendor‑provided patch as soon as possible is the recommended mitigative action.