CVE-2026-31965

A flaw was found in HTSlib, a library for reading and writing bioinformatics file formats. This vulnerability, an out-of-bounds read, occurs in the `cram_decode_slice()` function when processing CRAM (Compressed Reference-oriented Alignment Map) records due to delayed validation of the reference ID field. A remote attacker could exploit this by providing a specially crafted CRAM file, potentially leading to the disclosure of two memory values or causing the program to crash, resulting in a Denial of Service (DoS).