A NULL pointer dereference vulnerability in the HTSlib bioinformatics library can be exploited by unauthenticated attackers to cause a denial of service via application crashes.

The vulnerability exists within the CONST, XPACK, and XRLE encodings of the CRAM format handling. An unauthenticated attacker can trigger a NULL pointer dereference by providing a malicious bioinformatics file that forces the library to process omitted sequence or quality data improperly.

The primary risk associated with this vulnerability is a denial of service. By inducing a NULL pointer dereference, an attacker can crash applications that rely on HTSlib for data processing, potentially disrupting critical bioinformatics workflows. While the CVSS score of 7.5 indicates a high severity due to the ease of remote exploitation, the impact is primarily limited to service availability rather than data exfiltration or unauthorized system access.

Immediate Action: Update HTSlib to version 1.21.1, 1.22.2, or 1.23.1, depending on your current deployment branch, to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for repeated application crashes or segmentation faults occurring during the processing of CRAM files.

Compensating Controls: Implement input validation or sandboxing for untrusted bioinformatics files to prevent them from reaching the HTSlib processing engine.

Public Exploit Available: Unknown.

Organizations utilizing HTSlib should prioritize patching the library as soon as possible to prevent potential service disruptions. Although the impact is localized to application stability, the ease of triggering this flaw through malformed files necessitates an update to the latest provided version to ensure operational continuity and system reliability.