Read the docs
TI-2026-24516 Aliases CVE-2026-31972

samtools mpileup has use-after-free leading to an invalid read

Priority LOW 37CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

SAMtools is a program for reading, manipulating and writing bioinformatics file formats. The `mpileup` command outputs DNA sequences that have been aligned against a known reference. On each output line it writes the reference position, optionally the reference DNA base at that position (obtained from a separate file) and all of the DNA bases that aligned to that position. As the output is ordered by position, reference data that is no longer needed is discarded once it has been printed out. Under certain conditions the data could be discarded too early, leading to an attempt to read from a pointer to freed memory. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. This bug is fixed in versions 1.21.1 and 1.22. There is no workaround for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Fixed samtools (samtools): 1.21.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
samtoolssamtoolsbefore 1.21.11.21.1Patch availableCNA
  • samtools Vendorsamtools Affected before 1.21.1 Fixed in 1.21.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:samtools:samtools:*:*:*:*:*:*:*:*before 1.21.1Vulnerablesamtools
  • cpe:2.3:a:samtools:samtools:*:*:*:*:*:*:*:* Versions before 1.21.1 Vulnerable ·samtools

Remediation

  • Fix · CNA samtools (samtools) Fixed in 1.21.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31972
  2. 2026-10-11 EPSS moved to the 50th–90th percentile
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 2

  • TI-2026-24517 NULL pointer dereference in samtools cram-size CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences