CVE-2026-31973

Name: CVE-2026-31973
Creator: NVD / NIST
Published: 2026-03-18T21:16:26.25+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.9/10EPSS 0.52%

Last modified Jun 17, 2026

CVE-2026-31973 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. EPSS estimates a 0.52% chance of exploitation in the next 30 days.

Description

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 4.0

6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.52%

40.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-476

Affected Software

Vendor	Product	Versions
Samtools	Samtools	>= 1.17, <= 1.21.1
Samtools	Samtools	>= 1.22, < 1.22.2
Samtools	Samtools	1.23

References

https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2fPatch
https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/18/12Mailing List, Third Party Advisory

Timeline

Published: Mar 18, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-31973?

How severe is CVE-2026-31973?

CVE-2026-31973 has a CVSS score of 6.9/10 (MEDIUM severity). The EPSS model estimates a 0.52% probability of exploitation in the next 30 days.

How do I fix CVE-2026-31973?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-31973?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST