Log in Start free

Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M

CVE-2026-31973NULL pointer dereference in samtools cram-size

Medium 6.9

In plain English

A medium-severity null pointer dereference in samtools from samtools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.6%top 53.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the `cram_decode_compression_header()` was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12samtoolsno fix listedDEBIAN-CVE-2026-31973
Debian:13samtoolsno fix listedDEBIAN-CVE-2026-31973
Debian:14samtools1.24-2DEBIAN-CVE-2026-31973
Ubuntu:22.04:LTSsamtoolsno fix listedUBUNTU-CVE-2026-31973
Ubuntu:24.04:LTSsamtoolsno fix listedUBUNTU-CVE-2026-31973
Ubuntu:25.10samtoolsno fix listedUBUNTU-CVE-2026-31973
Ubuntu:26.04:LTSsamtoolsno fix listedUBUNTU-CVE-2026-31973
Ubuntu:26.10samtoolsno fix listedUBUNTU-CVE-2026-31973

Affected products (as reported)

VendorProductVersions
samtools samtools >= 1.17, < 1.21.1>= 1.22, < 1.22.2= 1.23

Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References