The vulnerability occurs in the cram_decode_slice() function of htslib, where validation of the reference id field happens too late in the decoding process. This allows two out-of-bounds reads that could leak values to the caller or cause a crash when the function attempts to access invalid memory. The primary impact is memory corruption and potential information leakage, categorized under CWE-125 (Out-of-Bounds Read) and CWE-129 (Race Condition, Logical).

Affected products include the htslib library used by SamTools. Versions 1.23.1, 1.22.2, and 1.21.1 are vulnerable. The corresponding CPE strings are cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:* and cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*.

The CVSS score of 6.9 indicates a medium severity vulnerability, while the EPSS score of less than 1% denotes a low probability of exploitation. It is not listed in the CISA KEV catalog, implying no known widespread exploitation. The likely attack vector is local or remote if a malicious CRAM file can be supplied to the software; however, a successful exploit requires the ability to provide malformed CRAM data to the application.