CVE-2026-116742 HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count

Medium 4.8 Published 26 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116742?

CVE-2026-116742 is a medium-severity vulnerability in samtools htslib, published on 26 Oct 2026.

Official description

HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.

Weakness: CWE-197

Which versions are affected by CVE-2026-116742?

How do I fix CVE-2026-116742?

No fix has been published for CVE-2026-116742 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116742 being exploited?

There is no known exploitation of CVE-2026-116742 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-116742, GHSA-r296-8jjg-794r, UBUNTU-CVE-2026-116742.