---
id: CVE-2026-116742
title: HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
summary: >-
  HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability
  in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap
  memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF
  truncat…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-197
vendor: samtools
product: htslib
affected:
  - htslib <= 1.24
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-27T13:42:04.833817Z'
published: '2026-10-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:16:48.820Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116742'
references:
  - url: 'https://github.com/samtools/htslib/pull/2057'
    label: 'Pull Request #2057'
  - url: >-
      https://github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2873
    label: Patch Commit
  - url: 'https://github.com/samtools/htslib'
  - url: 'https://github.com/samtools/htslib/blob/1.24/bgzf.c#L2504'
  - url: 'https://hackmd.io/@haindpwn/htslib-bgzf-gzi-int-truncation-oob'
  - url: 'https://github.com/samtools/htslib/issues/2113'
  - url: >-
      https://www.vulncheck.com/advisories/htslib-through-1.24-heap-out-of-bounds-write-via-truncated-gzi-index-count
    label: >-
      VulnCheck Advisory: HTSlib through 1.24 Heap Out-of-Bounds Write via
      Truncated .gzi Index Count
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02105
ingestedAt: '2026-10-27T16:11:59.456Z'
---

## Overview

HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.

## Affected

- `htslib <= 1.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.