CVE-2021-28027
Loading a bgzip block can write out of bounds if size overflows.
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
- Record
CVE-2021-28027- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-191
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
- Record
CVE-2021-28027- Updated
- 2026-11-02
EUVDEUVD-2022-3606 No score
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
- Record
EUVD-2022-3606- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cpqj-r29q-chrh
Loading a bgzip block can write out of bounds if size overflows.
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
- Record
GHSA-cpqj-r29q-chrh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
OSVGHSA-cpqj-r29q-chrh
Loading a bgzip block can write out of bounds if size overflows.
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
- Record
GHSA-cpqj-r29q-chrh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-191
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0027
Loading a bgzip block can write out of bounds if size overflows.
Affected versions of bam set the length of an internal buffer using
self.compressed.set_len(block_size - HEADER_SIZE - MIN_EXTRA_SIZE) and then
wrote into it. While block_size was constrained to a proper maximum, when it
was too small the subtraction could overflow negatively to a large number past
the capacity of self.compressed.
This can result in memory corruption in the form of writing out of bounds when
loading a bgzip file with a small block_size.
Commit 061eee38d4 fixed this issue by checking for the underflow when setting
the buffer size.
- Record
RUSTSEC-2021-0027- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28027 is a critical vulnerability (CVSS 9.8) in Bam Project Bam, published January 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. Fixed in bam 0.1.3.