A heap and stack-based buffer overflow vulnerability in HTSlib allows unauthenticated attackers to potentially achieve arbitrary code execution by providing a crafted bioinformatics file.

The vulnerability exists in the cram_byte_array_len_decode() function, which fails to validate input lengths against output buffer sizes during CRAM data processing. This flaw allows an unauthenticated user who triggers the parsing of a malicious file to cause memory corruption or arbitrary code execution.

Successful exploitation of this vulnerability poses a significant risk to data integrity and system availability. Given the CVSS score of 8.1, the potential for arbitrary code execution necessitates immediate attention, as it could lead to full system compromise or the unauthorized alteration of critical bioinformatics research data.

Immediate Action: Update HTSlib to version 1.21.1, 1.22.2, or 1.23.1 or later to implement the necessary input validation fixes.

Proactive Monitoring: Monitor system logs for unexpected application crashes or memory access violations associated with bioinformatics processing tools.

Compensating Controls: Since no workarounds exist, ensure that all bioinformatics data files are sourced from trusted origins and perform deep packet inspection or file scanning where feasible to identify malformed CRAM structures.

Public Exploit Available: No (exploit_available: false)

The severity of this memory safety vulnerability, combined with its potential for arbitrary code execution, requires prompt remediation. IT administrators should prioritize updating all instances of HTSlib to the patched versions provided by the vendor to eliminate the risk of exploitation.