Live › vulnerability › CVE-2026-116742
Go to dashboardHTSlib through 1.24 mishandles a .gzi index entry count of 0xFFFFFFFF in bgzf_index_load_hfile(), so noffs truncates to zero and writes go past a malloc(0) buffer. An attacker who supplies a crafted index file can corrupt heap memory, causing crashes or possibly further memory corruption in tools such as samtools and bcftools.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Teams that run HTSlib-based tools such as samtools or bcftools on untrusted or externally supplied BGZF and index files, for example in genomics pipelines or file-processing services. Systems that only process files they generated themselves are much less exposed. The sources do not say whether the flaw reaches code execution in practice.
No product ranges from the sources yet.
samtools --version and compare it with the fixed release in the sources (unknown from the sources)..gzi indexes, for example in pipelines that accept user-uploaded BAM, VCF or BGZF inputs..gzi files from untrusted sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.
This page as .md · .json · in your agent: get_signal("CVE-2026-116742")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.