CVE-2019-10269: Burrow-Wheeler Aligner Project Burrow-Wheeler Aligner

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name in a .alt file.

Affected products

• Burrow-Wheeler Aligner Project Burrow-Wheeler Aligner: before 2019-01-23 (fixed in 2019-01-23)
• Canonical Ubuntu Linux: version 18.04 only; version 19.04 only

Published 2019-03-29. Last modified 2026-06-17.