CVE-2018-11129: The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause...

Security readout for executives and security teams

VCFtools 0.1.15 can crash, and may have other unspecified effects, when it processes a maliciously crafted VCF file. The business risk is highest where genomic data files from outside parties enter automated analysis pipelines. Likely exposure is limited to systems running VCFtools 0.1.15 or affected distro packages that process untrusted VCF files. Internet exposure is not implied unless a public service accepts and parses uploaded VCF data. Treat as a targeted operational risk for genomics and research environments, not a broad enterprise emergency. Prioritize patching where external VCF files are processed automatically or where pipeline downtime would disrupt clinical, research, or customer commitments. Mitigation focus: Apply vendor vcftools security updates from Ubuntu, Debian, or your package source.; Inventory bioinformatics pipelines that process externally supplied VCF files.; Restrict untrusted VCF processing to isolated, least-privileged environments..

Prepared

Jun 7, 2026, 13:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.