Multiple vulnerabilities in samtools up to version 1.24 and fixes in 1.25

What happened and what to do

The advisory, published on October 27, 2026 by Robert Davies on the oss-sec list, discloses multiple vulnerabilities in the samtools package, a tool used to manipulate sequence alignment files. All were fixed in version 1.25 and also backported to versions 1.24.1, 1.23.3, 1.22.4 and 1.21.3. Because CVE number assignment is delayed at GitHub, the advisory points to GitHub pages that will be updated automatically once the identifiers are assigned.

In practice, companies running samtools in bioinformatics pipelines, sequencing laboratories or internal data workflows first need to know where the tool is installed, including containers, machine images and workstations, and which version each one runs. The path then is to upgrade to 1.25 or to the backported version matching each development line, rebuild container images and pin versions in pipelines. It is also worth automating version checks in CI and tracking the GitHub pages to see the CVEs once they are published.

How the consultancy can help

Exposure diagnosis: mapping where samtools is installed across pipelines, containers and workstations, with the versions in use. Then a scoped upgrade plan and automated version checks in CI, with continuous monitoring of security advisories.

Next step

If your team runs samtools in data or analysis pipelines, send a short description of your environment and receive a scoped proposal for diagnosis and upgrade.