HTSlib through 1.10.2 allows out-of-bounds write access in vcfparseformat (called from vcfparse and vcfread).
{ "urgency": "not yet assigned" }