CVE-2026-31973 | SAMtools up to 1.21.0/1.22.1/1.23 CRAM File Parser cram_decode_compression_header null pointer dereference (GHSA-x86f-q6fj-cm43)

A vulnerability was found in SAMtools up to 1.21.0/1.22.1/1.23. It has been declared as problematic. This issue affects the function cram_decode_compression_header of the component CRAM File Parser. The manipulation results in null pointer dereference.

This vulnerability is known as CVE-2026-31973. It is possible to launch the attack remotely. No exploit is available.

It is recommended to upgrade the affected component.