HTSlib’s BGZF index file reader contains a heap buffer overflow triggered by an integer overflow in the bgzf_index_load_hfile() function. A crafted .gzi file can cause an under‑or zero‑sized buffer allocation, leading to 16 arbitrary bytes being written and, depending on the overflow, the remainder of the file being loaded. The overflow ultimately causes a crash or corruption of heap structures, potentially allowing arbitrary code execution. This weakness is associated with several known CVEs including CWE‑122, CWE‑1284, CWE‑131, CWE‑190, and CWE‑787.

The vulnerability affects the htslib component of samtools. Versions prior to 1.21.1, 1.22.2 and 1.23.1 are vulnerable. The CPE entries include htslib:htslib 1.23 and any earlier releases. Users running older releases of htslib should verify their version.

The CVSS score for this issue is 7.1, indicating a high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower probability of widespread exploitation. Attackers would need to supply a malicious .gzi index file to an application that uses HTSlib; thus the vector is local file input. If an attacker can supply such a file, the resulting heap buffer overflow could allow code execution or denial of service.