A heap and stack-based buffer overflow vulnerability in HTSlib, a library for bioinformatics data, could allow an unauthenticated attacker to achieve arbitrary code execution via a crafted file.

This vulnerability is a memory corruption issue (CWE-121, CWE-122, CWE-787) occurring when processing CRAM files. Improper validation of VARINT and CONST encodings allows an unauthenticated attacker to perform out-of-bounds writes, leading to potential arbitrary code execution.

The exploitation of this vulnerability poses a severe risk to data integrity and system availability. If an attacker successfully triggers the overflow, they could crash critical bioinformatics pipelines, corrupt research data, or gain unauthorized control over the processing system. Given the CVSS score of 8.1, this is a high-severity threat that requires immediate attention to prevent system compromise.

Immediate Action: Update HTSlib to version 1.21.1, 1.22.2, 1.23.1, or later versions where these vulnerabilities are patched.

Proactive Monitoring: Monitor system logs for unexpected application crashes or segmentation faults when processing bioinformatics data files.

Compensating Controls: Implement strict input validation or sandboxing for any services that automatically ingest or process CRAM files from untrusted sources to limit the impact of potential exploits.

Public Exploit Available: Unknown

Organizations utilizing HTSlib within their research or data processing environments must prioritize updating to the latest versions. Because this flaw allows for memory corruption through crafted files, the risk of exploitation is significant for any system that handles external bioinformatics data. Apply the provided patches immediately to remediate the underlying memory safety issues.