CVE-2026-31973

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

• CWE-476

• https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2fPatch
• https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/03/18/12Mailing List, Third Party Advisory

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31968HTSlib is a library for reading and writing bioinformatics f…8.1
• CVE-2026-31969HTSlib is a library for reading and writing bioinformatics f…8.1
• CVE-2026-3197Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-31970HTSlib is a library for reading and writing bioinformatics f…8.1
• CVE-2026-31971HTSlib is a library for reading and writing bioinformatics f…8.1
• CVE-2026-31972SAMtools is a program for reading, manipulating and writing …9.8
• CVE-2026-31974OpenProject is an open-source, web-based project management …4.3
• CVE-2026-31975Cloud CLI (aka Claude Code UI) is a desktop and mobile UI fo…9.8
• CVE-2026-31976xygeni-action is the GitHub Action for Xygeni Scanner. On Ma…9.8
• CVE-2026-31978motionEye (mEye) is an online interface for motion software,…6.5
• CVE-2026-31979Himmelblau is an interoperability suite for Microsoft Azure …7.8
• CVE-2026-3198MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails…6.5