CVE-2020-36403

HIGH EPSS 72.4%
Published Jul 1, 20215y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Jul 1, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
72.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 2

VendorProductVersionRange
htslibhtslib* ≤1.10.2
linuxlinux_kernel*any

References 4

  • bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097
    ExploitIssue TrackingPatchThird Party Advisory
  • github.com https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2020-955.yaml
    Third Party Advisory
  • github.com https://github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72c
    PatchThird Party Advisory
  • github.com https://github.com/samtools/htslib/pull/1447
    ExploitThird Party Advisory

Remediation

  • bugs.chromium.org https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097
    ExploitIssue TrackingPatchThird Party Advisory
  • github.com https://github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72c
    PatchThird Party Advisory