CVE-2026-31965

CVE-2026-31965 is a high-severity out-of-bounds read vulnerability in HTSlib, a library for bioinformatics file formats, affecting versions prior to 1.23.1, 1.22.2, and 1.21.1. The flaw occurs in the cram_decode_slice() function during CRAM record processing, where delayed validation of the reference ID field allows two out-of-bounds reads. Rated CVSS 8.2 (High), this vulnerability could lead to limited information disclosure or a denial-of-service condition due to program crashes. Despite its severity, the EPSS score is very low, and there is currently no evidence of active exploitation, public exploit code, or significant community discussion. Organizations are advised to update HTSlib to a patched version, as no workaround exists.