A heap-based buffer overflow in the HTSlib bioinformatics library can be exploited by an unauthenticated attacker to cause a crash or achieve arbitrary code execution via malicious file processing.

This vulnerability is a heap-based buffer overflow (CWE-122) caused by an integer overflow in the bgzf_index_load_hfile function. An unauthenticated attacker can trigger this flaw by enticing a user to open a specially crafted GZI index file.

The exploitation of this vulnerability poses a significant risk to data integrity and system availability. Successful execution allows for memory corruption, which may lead to application crashes or potentially arbitrary code execution on the host system. Given the CVSS score of 8.1, the vulnerability represents a high-severity threat that could lead to full system compromise if leveraged in an environment processing untrusted bioinformatics data.

Immediate Action: Update HTSlib to version 1.21.1, 1.22.2, 1.23.1, or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor systems for unexpected application crashes or anomalous memory usage patterns when processing bioinformatics file formats.

Compensating Controls: Until patching is complete, discard GZI index files from untrusted sources and utilize the bgzip -r command to recreate index files from trusted source data.

Public Exploit Available: Unknown

Organizations utilizing HTSlib must prioritize the update to the latest patched versions to eliminate the risk of heap-based memory corruption. Given the nature of bioinformatics data processing, which often involves external or community-shared files, the risk of encountering a malicious GZI file is credible. Immediate implementation of the patch is the only definitive way to secure the environment against this vulnerability.