HTSlib CRAM Reader Out-of-Bounds Read Vulnerability Allowing Data Leakage

A vulnerability in HTSlib's CRAM reader can lead to an out-of-bounds read, allowing arbitrary data to be leaked. This issue arises from improper validation of feature data in CRAM files, which use reference-based compression to store DNA sequence alignment data. The flaw enables the `cram_decode_seq()` function to copy data from outside the bounds of the reference into output buffers, potentially disclosing information about the program's state or causing a crash by accessing invalid memory.

Impact

Exploitation of this vulnerability can result in unauthorized data leakage and may cause a program crash due to invalid memory access.

Remediation

Users can upgrade to HTSlib versions 1.21.1, 1.22.2, or 1.23.1 to address this vulnerability.