CVE-2026-116742
HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
samtools htslib
CVSS
4.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.
Text from CVE List
Affected versions 1
- htslibaffected: all versions through 1.24CVE List
References 7
- github.com/samtools/htslib/pull/2057Fixvia CVE List
- github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2873Fixvia CVE List
- hackmd.io/@haindpwn/htslib-bgzf-gzi-int-truncation-oobAdvisoryvia CVE List
- vulncheck.com/advisories/htslib-through-1.24-heap-out-of-bounds-write-via-truncated-gzi-index-countAdvisoryvia CVE List
- github.com/samtools/htslibReferencevia CVE List
- github.com/samtools/htslib/blob/1.24/bgzf.c#L2504Referencevia CVE List
- github.com/samtools/htslib/issues/2113Referencevia CVE List