{"id":"CVE-2026-31973","summary":"NULL pointer dereference in samtools cram-size","details":"SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.","aliases":["GHSA-x86f-q6fj-cm43"],"modified":"2026-04-10T05:42:54.860507Z","published":"2026-03-18T20:34:00.846Z","database_specific":{"cna_assigner":"GitHub_M","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31973.json","cwe_ids":["CWE-476"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/03/18/12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31973.json"},{"type":"ADVISORY","url":"https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31973"},{"type":"FIX","url":"https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/samtools/samtools","events":[{"introduced":"4959cc981ad9725d3c6007687ca372ffcdaa3c80"},{"fixed":"063c0ed98dcfe9d64238098c693713cd915d7532"}],"database_specific":{"versions":[{"introduced":"1.17"},{"fixed":"1.21.1"}]}},{"type":"GIT","repo":"https://github.com/samtools/samtools","events":[{"introduced":"da72567097265a61650a081c9f68d4a9f45bd105"},{"fixed":"b74903f69aa69a8435a2b5d66b2a6ca67f381a8e"}],"database_specific":{"versions":[{"introduced":"1.22"},{"fixed":"1.22.2"}]}},{"type":"GIT","repo":"https://github.com/samtools/samtools","events":[{"introduced":"0"},{"last_affected":"32e616e651459318696b0810248060400618374c"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"= 1.23"}]}}],"versions":["0.1.1","0.1.10","0.1.11","0.1.12","0.1.12a","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2-svntag","0.1.2-tarball","0.1.20","0.1.3","0.1.4","0.1.5","0.1.5a","0.1.5b","0.1.5c","0.1.6","0.1.7","0.1.7a","0.1.8","0.1.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.15.1","1.16","1.16.1","1.17","1.18","1.19","1.19.1","1.19.2","1.2","1.20","1.21","1.22","1.22.1","1.23","1.3","1.3.1","1.4","1.4.1","1.5","1.6","1.7","1.8","1.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31973.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}