NULL pointer dereference in samtools cram-size
Summary
NULL pointer dereference in samtools cram-size
Original description
The description as published by the source.
SAMtools is a program for reading, manipulating and writing bioinformatics file formats. Starting in version 1.17, in the cram-size command, used to write information about how well CRAM files are compressed, a check to see if the cram_decode_compression_header() was missing. If the function returned an error, this could lead to a NULL pointer dereference. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-31973 samtools
- Ubuntu UBUNTU-CVE-2026-31973 samtools
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web openwall.com