Back Linuxsecurity

Fedora 42 htslib Urgent Heap Overflow Vulnerability for Code Execution

Linuxsecurity •LinuxSecurity Advisories • March 28, 2026

HTSlib is an implementation of a unified C library for accessing common file formats, such as SAM, CRAM and VCF, used for high-throughput sequencing data, and is the core library used by samtools and bcftools. Update Information : Update to 1.23.1

HTSlib is an implementation of a unified C library for accessing common file

formats, such as SAM, CRAM and VCF, used for high-throughput sequencing data,

and is the core library used by samtools and bcftools.

* Thu Mar 19 2026 Rasmus Ory Nielsen - 1.23.1-1 - Updated to 1.23.1 * Thu Jan 22 2026 Rasmus Ory Nielsen - 1.23-1 - Updated to 1.23 - Removed outdated patch * Fri Jan 16 2026 Fedora Release Engineering - 1.15.1-10 - Rebuilt for * Thu Jul 24 2025 Fedora Release Engineering - 1.15.1-9 - Rebuilt for

[ 1 ] Bug #2448750 - CVE-2026-31962 htslib: htslib: Heap buffer overflow leading to arbitrary code execution via crafted CRAM file [ 2 ] Bug #2448751 - CVE-2026-31965 htslib: HTSlib: Information disclosure or denial of service via out-of-bounds read in CRAM record processing [ 3 ] Bug #2448755 - CVE-2026-31963 htslib: HTSlib: Arbitrary code execution via crafted CRAM file [ 4 ] Bug #2448756 - CVE-2026-31964 htslib: HTSlib: Denial of Service via NULL pointer dereference in CRAM decoding

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1fc0d39acd' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Heap Overflow Vulnerability in Fedora 42 Affects Samtools and HTSlib A critical heap overflow vulnerability has been identified in the htslib library, which is crucial for high-throughput sequencing data processing in Fedora 42. This vulnerability, cataloged under CVE-2026-31962, allows for arbitrary code execution via crafted CRAM files. Other related vulnerabilities include CVE-2026-31963, CVE-2026-31964, and CVE-2026-31965, which involve denial of service and information disclosure. Users of samtools and bcftools, which rely on htslib, are particularly affected. The vulnerabilities were published on March 18, 2026, and an update to version 1.23.1 has been released to mitigate these issues. The update can be installed using the 'dnf' package manager. Security professionals are advised to apply the update promptly to protect against potential exploitation. 2 sources 73

Extracted Entities

Companies (1)

Fedora

CVEs (4)

CVE-2026-31962 CVE-2026-31963 CVE-2026-31964 CVE-2026-31965