CVE-2026-31973 NULL pointer dereference in samtools cram-size
A missing error check in samtools cram-size allows a NULL pointer dereference, causing the application to crash when processing malformed CRAM files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31973?
CVE-2026-31973 is a medium-severity vulnerability in samtools, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
Weakness: CWE-476
Which versions are affected by CVE-2026-31973?
It affects 1 product.
Products include Samtools Samtools.
How do I fix CVE-2026-31973?
No fix has been published for CVE-2026-31973 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-31973 being exploited?
There is no known exploitation of CVE-2026-31973 in the wild and no public exploit code.
Other vulnerabilities in samtools
Sources
Also known as DEBIAN-CVE-2026-31973, GHSA-x86f-q6fj-cm43, UBUNTU-CVE-2026-31973.