Bug 2448857 (CVE-2026-31972) - CVE-2026-31972 samtools: SAMtools: Information Disclosure and Denial of Service via use-after-free vulnerability in mpileup command
Summary: CVE-2026-31972 samtools: SAMtools: Information Disclosure and Denial of Servi...
Keywords:
Status: NEW
Alias: CVE-2026-31972
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2449264 2449263 2449265 2449266
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-18 21:02 UTC by OSIDB Bzimport
Modified: 2026-03-19 22:47 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-18 21:02:05 UTC
SAMtools is a program for reading, manipulating and writing bioinformatics file formats. The `mpileup` command outputs DNA sequences that have been aligned against a known reference. On each output line it writes the reference position, optionally the reference DNA base at that position (obtained from a separate file) and all of the DNA bases that aligned to that position. As the output is ordered by position, reference data that is no longer needed is discarded once it has been printed out. Under certain conditions the data could be discarded too early, leading to an attempt to read from a pointer to freed memory. This bug may allow information about program state to be leaked. It may also cause a program crash through an attempt to access invalid memory. This bug is fixed in versions 1.21.1 and 1.22. There is no workaround for this issue.


Note You need to log in before you can comment on or make changes to this bug.