The flaw exists in the cram-size command of SAMtools starting from version 1.17, where a missing check on the return value of cram_decode_compression_header() can lead to a NULL pointer dereference. The resulting crash causes the program to terminate, disrupting any bioinformatics pipeline that relies on SAMtools. This is a policy‑flaw type of memory error (CWE‑476).

Affected product: samtools:samtools. Versions from 1.17 up to, but not including, the patched releases 1.21.1, 1.22.2, and 1.23.1 are vulnerable. The patch is included in releases 1.21.1, 1.22.2, and 1.23.1; any installation older than 1.21.1 is at risk.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability requires an attacker to invoke cram-size with a CRAM header that causes cram_decode_compression_header() to fail, which would likely need local or restricted input access. Once triggered, the application crashes, providing a denial‑of‑service to legitimate users but not affecting confidentiality or integrity of other systems.