HTSlib contains an out‑of‑bounds read in the cram_decode_slice() function due to lack of validation of the mate reference id field. This flaw allows an attacker who supplies a malicious CRAM file to cause the library to read beyond intended array bounds and potentially expose internal program state or crash the process. The weakness matches the Common Weakness Enumerations CWE-125 and CWE-129, indicating an out‑of‑bounds read and signed/unsigned mismatch. The impact is limited to information disclosure and denial of service within the context of the application using the library; it does not provide remote code execution or privilege escalation on its own.

Affected products are HTSlib used within the samtools:htslib ecosystem. The vulnerability is present in releases 1.21.1, 1.22.2, and 1.23.0. Fixes are included in version 1.23.1 and later releases. No other vendors or products are listed in the known CNA data.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is below 1%, suggesting that the likelihood of active exploitation is low, and the issue is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to supply a crafted CRAM file to a vulnerable application; no remote network attack vector is specified in the input. Thus, the overall risk is moderate but depends on whether the affected HTSlib version is used in publicly accessible pipelines.