A heap buffer overflow in the HTSlib library allows an unauthenticated attacker to potentially achieve arbitrary code execution by providing a specially crafted CRAM file.

The vulnerability stems from improper handling of specific CRAM records in the cram_decode_seq function, leading to an out of bounds read followed by an attacker controlled byte write to heap memory. This flaw does not require authentication to trigger.

The vulnerability carries a CVSS score of 8.8, reflecting its high impact on system integrity. Successful exploitation could allow an attacker to crash the application or achieve arbitrary code execution, potentially leading to total system compromise and unauthorized data access within environments processing bioinformatics data.

Immediate Action: Update HTSlib to version 1.21.1, 1.22.2, 1.23.1, or later, as these versions contain the necessary security patches.

Proactive Monitoring: Monitor systems for unexpected application crashes or anomalous memory usage patterns when processing CRAM files, as these may indicate attempted exploitation.

Compensating Controls: Since there is no workaround, prioritize restricting the processing of untrusted or externally sourced CRAM files until the library can be updated.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution and the lack of a viable workaround, it is critical to upgrade to the patched versions of HTSlib immediately. Organizations should audit their dependency trees to identify and remediate all instances of the affected HTSlib versions to mitigate the risk of exploitation.