A NULL pointer dereference vulnerability in SAMtools allows unauthenticated attackers to cause a denial of service by triggering application crashes.

The software fails to validate the return value of the cram_decode_compression_header function within the cram-size command. This allows an unauthenticated attacker to supply a specially crafted file that triggers a NULL pointer dereference, resulting in an application crash.

The vulnerability carries a CVSS score of 7.5, indicating a significant risk to availability. Exploitation results in the immediate termination of the SAMtools process, which can disrupt bioinformatics workflows, cause data processing delays, and impact research productivity. Because the flaw is reachable without authentication, it poses a notable risk to systems that process untrusted CRAM files.

Immediate Action: Update SAMtools to version 1.21.1, 1.22.2, or 1.23.1 to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for repeated application crashes or unexpected terminations of the SAMtools process during file processing tasks.

Compensating Controls: Implement strict input validation or sandboxing for bioinformatics files obtained from untrusted or external sources to prevent the execution of malicious CRAM files.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing SAMtools for large-scale data analysis should prioritize updating to the latest versions to ensure stability and resilience against denial of service attacks. Given the ease of exploitation, administrators should treat this update as a standard security maintenance requirement to prevent potential workflow disruptions.