High severity · published Mar 18, 2026
CVE-2026-31973
NULL pointer dereference in samtools cram-size
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
samtools · samtools
>= 1.17, < 1.21.1; >= 1.22, < 1.22.2; = 1.23 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-31973
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-31973
Patch
https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f
Vendor Advisory
https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43
Mailing List
http://www.openwall.com/lists/oss-security/2026/03/18/12
More from samtools
9.8
CVE-2026-31972
samtools mpileup has use-after-free leading to an invalid read