HTSlib Heap Buffer Overflow Vulnerability in CRAM Decoder

A heap buffer overflow vulnerability has been identified in HTSlib, a library for handling bioinformatics file formats. This issue arises in the CRAM decoder when processing data encoded with the 'BYTE_ARRAY_STOP' method. An out-by-one error in the 'cram_byte_array_stop_decode_char()' function allows an attacker-controlled byte to be written beyond the end of a heap allocation. This exploitation can lead to program crashes, unintended data and heap structure modifications, and potentially arbitrary code execution.

Impact

Exploitation of this vulnerability causes a heap buffer overflow, which can lead to program crashes, unexpected modifications of data and heap structures, and possibly arbitrary code execution.

Remediation

Users can upgrade to HTSlib versions 1.21.1, 1.22.2, or 1.23.1 to address this vulnerability.