SAMtools NULL Pointer Dereference Vulnerability in CRAM Compression Handling

A NULL pointer dereference vulnerability has been identified in SAMtools versions 1.17 through 1.21, as well as 1.22, 1.22.1, and 1.23. This issue arises in the 'cram-size' command, which reports on CRAM file compression efficiency. The vulnerability occurs because a necessary check for the 'cram_decode_compression_header()' function was omitted. If this function encounters an error, it can result in a NULL pointer dereference, causing the program to crash.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing the program to crash.

Remediation

Users can upgrade to SAMtools versions 1.21.1, 1.22.2, or 1.23.1 to address this vulnerability.