CVE-2020-36403

HTSlib 1.10 through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from...

8.8 HighFix available

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.59%Up 0.8 points since Jul 1, 2021

What each source reports

NVD Score used 8.8

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Record: CVE-2020-36403
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Record: CVE-2020-36403
Updated: 2026-11-02

EUVDEUVD-2020-23931 No score

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Record: EUVD-2020-23931
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9cpm-77gg-x323 8.8

HTSlib 1.10 through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from...

HTSlib 1.10 through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Record: GHSA-9cpm-77gg-x323
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 8.8

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Record: CVE-2020-36403
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-36403 8.8

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Record: DEBIAN-CVE-2020-36403
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVOESA-2022-1962 8.8

htslib security update

HTSlib is an implementation of a unified C library for accessing common file formats, such as SAM, CRAM and VCF, used for high-throughput sequencing data, and is the core library used by samtools and bcftools. HTSlib only depends on zlib. It is known to be compatible with gcc, g++ and clang. HTSlib implements a generalized BAM index, with file extension .csi ( coordinate-sorted index). The HTSlib file reader first looks for the new index and then for the old if the new index is absent.

Security Fix(es):

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).(CVE-2020-36403)

Record: OESA-2022-1962
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2022-1963 8.8

htslib security update

Security Fix(es):

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).(CVE-2020-36403)

Record: OESA-2022-1963
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-36403 8.8

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Record: UBUNTU-CVE-2020-36403
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2021:1177-1 No score

Security update for libhts

This update of libhts fixes the following security issue:

CVE-2020-36403: Fixed an out-of-bounds write access in vcf_parse_format() (bsc#1187917)

Record: openSUSE-SU-2021:1177-1
Updated: 2026-11-02

Affected products

htslib

Affected packages

Affected packages
Package	Affected	Fixed
`htslib` Debian:12	before 1.11-1	1.11-1
`htslib` Debian:13	before 1.11-1	1.11-1
`htslib` Debian:14	before 1.11-1	1.11-1
`htslib` openEuler:20.03-LTS-SP1	before 1.11-1.oe1	1.11-1.oe1
`htslib` openEuler:20.03-LTS-SP3	before 1.11-1.oe1	1.11-1.oe1
`htslib` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 0.2.0~rc3-10.2.0~rc3-1ubuntu0.1~esm1	None known
`htslib` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.2.1-11.2.1-21.2.1-2ubuntu11.2.1-2ubuntu1+esm1	None known
`htslib` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.5-11.5-4ubuntu11.6-3ubuntu11.6-41.6-4build11.7-21.7-2ubuntu0.1~esm1	None known
`htslib` Ubuntu:20.04:LTS	All versions, plus listed versions 1.9-101.9-111.9-121.10.2-2ubuntu11.10.2-2ubuntu21.10.2-31.10.2-3ubuntu0.1	None known
`libhts` SUSE:Package Hub 15 SP2	before 1.10.2-bp153.2.5.1	1.10.2-bp153.2.5.1
`libhts` SUSE:Package Hub 15 SP3	before 1.10.2-bp153.2.5.1	1.10.2-bp153.2.5.1
`libhts` openSUSE:Leap 15.2	before 1.10.2-bp153.2.5.1	1.10.2-bp153.2.5.1
`libhts` openSUSE:Leap 15.3	before 1.10.2-bp153.2.5.1	1.10.2-bp153.2.5.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36403 is a high vulnerability (CVSS 8.8) in Htslib, published July 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in htslib 1.11-1.

References

Show 8 moreShow less