HTSlib Heap and Stack Buffer Overflow Vulnerability in CRAM Decoder

A buffer overflow vulnerability has been identified in HTSlib, a library for handling bioinformatics file formats. This issue arises in the CRAM decoder, specifically within the 'VARINT' and 'CONST' encodings. Incomplete validation of the encoding context can lead to up to eight bytes being written beyond the end of a heap allocation or to the location of a one-byte variable on the stack. This could cause adjacent variable values to change unexpectedly. Depending on the data stream, this vulnerability could result in a heap buffer overflow or a stack overflow. Exploitation of this issue could cause the program to crash, overwrite data structures in an unanticipated manner, disrupt the program's control flow, and potentially allow arbitrary code execution.

Impact

Exploitation could lead to a heap or stack buffer overflow, causing program crashes, unintended data overwrites, control flow changes, and possibly arbitrary code execution.

Remediation

Users can upgrade to HTSlib versions 1.21.1, 1.22.2, or 1.23.1 to address this vulnerability.