CVE-2026-116742 samtools CVE debrief

Who should care

Defenders responsible for maintaining and securing tools like samtools and bcftools should prioritize patching or upgrading to a fixed version of HTSlib. This includes operators, platform administrators, vulnerability management teams, and security teams. The vulnerability can cause significant disruptions to operations relying on these tools, and affected deployments should be identified and owners assigned for follow-up.

Why it matters

Defenders should prioritize patching or upgrading to a fixed version of HTSlib, as the vulnerability can cause heap corruption or crashes in tools like samtools and bcftools.

• Heap corruption or crashes in tools like samtools and bcftools
• Potential for attackers to exploit the vulnerability to corrupt heap memory

Technical summary

The vulnerability is caused by a crafted .gzi index entry count that can corrupt heap memory. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools. The vulnerability affects tools relying on HTSlib, such as samtools and bcftools. Defenders should prioritize patching or upgrading to a fixed version of HTSlib to prevent heap corruption or crashes. The issue has been tracked and patched by the vendor.

Defensive priority

Defenders should prioritize patching or upgrading to a fixed version of HTSlib, as the vulnerability can cause heap corruption or crashes.

Recommended defensive actions

• Patch or upgrade to a fixed version of HTSlib
• Review and update affected tools like samtools and bcftools
• Monitor for potential heap corruption or crashes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a crafted .gzi index entry count that can corrupt heap memory. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools. The issue has been tracked and patched by the vendor. Official CVE and NVD records provide additional context. Defenders should verify affected scope and apply patches or mitigations accordingly. Compensating controls may be necessary for short-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.