HTSlib is a widely used library for processing bioinformatics file formats, including the compressed CRAM format. The vulnerability lies in the handling of CONST, XPACK, and XRLE encodings when a CRAM record omits sequence or quality data. Because the decoder incorrectly writes to a null pointer under these conditions, the resulting crash is a classic NULL Pointer Dereference (CWE‑476). The impact is a denial‑of‑service condition; no direct data exfiltration or code execution is provided by the flaw itself.

The affected product is samtools:htslib. All releases of HTSlib that predates the specific patched versions are vulnerable. The CVE notes that versions 1.23.1, 1.22.2, and 1.21.1 contain the fix; therefore any older version (including 1.23.0, 1.22.1, 1.21.0, etc.) is considered vulnerable.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. The most plausible attack vector is the delivery of a malicious CRAM file that triggers the faulty decoder during normal processing, which could occur via a local user or a remote user submitting data to an application that incorporates HTSlib. The exploit will cause the consuming process to crash, leading to service interruption but not compromising other system components.