Is CVE-2026-31964 actively exploited?

No active exploitation of CVE-2026-31964 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-31964 be exploited remotely?

Yes. CVE-2026-31964 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-31964?

CVE-2026-31964 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-31964

HIGH

CVE-2026-31964

CWE-476Published: March 18, 2026· Updated: Mar 19, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.7th

Official Description

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. While most alignment records store DNA sequence and quality values, the format also allows them to omit this data in certain cases to save space. Due to some quirks of the CRAM format, it is necessary to handle these records carefully as they will actually store data that needs to be consumed and then discarded. Unfortunately the `CONST`, `XPACK` and `XRLE` encodings did not properly implement the interface needed to do this. Trying to decode records with omitted sequence or quality data using these encodings would result in an attempt to write to a NULL pointer. Exploiting this bug causes a NULL pointer dereference. Typically this will cause the program to crash. Versions 1.23.1, 1.22.2 and 1.21.1 include fixes for this issue. There is no workaround for this issue.

NVD Source

Technical Analysis

CVE-2026-31964 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.