Every CVE Search/ Get API key

CVE-2019-10269

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the...

9.8 CriticalFix available

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.91%Up 2.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Record
CVE-2019-10269
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Record
CVE-2019-10269
Updated
2026-11-02
EUVDEUVD-2019-2272 No score

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Record
EUVD-2019-2272
Updated
2026-11-03
GitHub AdvisoriesGHSA-m963-mf5c-ghpm 9.8

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the...

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Record
GHSA-m963-mf5c-ghpm
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 9.8

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Record
CVE-2019-10269
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-10269 9.8

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Record
DEBIAN-CVE-2019-10269
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2025-2796 9.8

bwa security update

BWA is a program for aligning sequencing reads against a large reference genome (e.g. human genome). It has two major components, one for read shorter than 150bp and the other for longer reads.

Security Fix(es):

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.(CVE-2019-10269)

Record
OESA-2025-2796
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2797 9.8

bwa security update

BWA is a program for aligning sequencing reads against a large reference genome (e.g. human genome). It has two major components, one for read shorter than 150bp and the other for longer reads.

Security Fix(es):

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.(CVE-2019-10269)

Record
OESA-2025-2797
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2798 9.8

bwa security update

BWA is a program for aligning sequencing reads against a large reference genome (e.g. human genome). It has two major components, one for read shorter than 150bp and the other for longer reads.

Security Fix(es):

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.(CVE-2019-10269)

Record
OESA-2025-2798
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2799 9.8

bwa security update

BWA is a program for aligning sequencing reads against a large reference genome (e.g. human genome). It has two major components, one for read shorter than 150bp and the other for longer reads.

Security Fix(es):

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.(CVE-2019-10269)

Record
OESA-2025-2799
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-10269 9.8

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Record
UBUNTU-CVE-2019-10269
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-4087-1 No score

BWA vulnerability

It was discovered that Burrows-Wheeler Aligner (BWA) mishandled certain crafted .alt files. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code.

Record
USN-4087-1
Updated
2026-11-02
OSVUSN-4857-1 No score

bwa vulnerability

It was discovered that Burrows-Wheeler Aligner (BWA) mishandled certain crafted .alt files. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code.

Record
USN-4857-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bwa
Debian:12
 before 0.7.17-3
0.7.17-3
bwa
Debian:13
 before 0.7.17-3
0.7.17-3
bwa
Debian:14
 before 0.7.17-3
0.7.17-3
bwa
openEuler:22.03-LTS-SP4
 before 0.7.17-2.oe2203sp4
0.7.17-2.oe2203sp4
bwa
openEuler:24.03-LTS
 before 0.7.17-2.oe2403
0.7.17-2.oe2403
bwa
openEuler:20.03-LTS-SP4
 before 0.7.17-2.oe2003sp4
0.7.17-2.oe2003sp4
bwa
openEuler:22.03-LTS-SP3
 before 0.7.17-2.oe2203sp3
0.7.17-2.oe2203sp3
bwa
Ubuntu:Pro:16.04:LTS
 before 0.7.12-5ubuntu0.1~esm1, plus listed versions
0.7.12-40.7.12-5
0.7.12-5ubuntu0.1~esm1
bwa
Ubuntu:18.04:LTS
 before 0.7.17-1ubuntu0.1, plus listed versions
0.7.15-50.7.16-10.7.17-1
0.7.17-1ubuntu0.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10269 is a critical vulnerability (CVSS 9.8) in Burrow-wheeler Aligner Project Aligner, published March 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.91%, the 87th percentile. Fixed in bwa 0.7.17-3.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open