Forensic DNA files can be rewritten in 45 minutes, a researcher demonstrated

Forensic DNA evidence can be rewritten, and a researcher did it in about 45 minutes using code written with Claude.

The demonstration

Nathan Adams, a systems engineer at the Ohio DNA consultancy Forensic Bioinformatics, demonstrated the flaw, now tracked as CVE-2026-17583 with a CVSS score of 8.2.

His first successful modification took about 45 minutes and combined scans from two separate DNA profiles into a single file that appeared untouched since 2015. Common forensic analysis software raised no warnings.

Scope of the problem

The vulnerability affects the .fsa and .hid output files from Thermo Fisher genetic analysers, including the 3500 and 3730 series, SeqStudio instruments and GeneMapper ID-X.

Researchers say digital records produced since 1995 may be affected, and they found no way to detect whether tampering already happened. That second half is the part with the longest shadow: absence of evidence of tampering is not, in this case, evidence of absence.

Thermo Fisher credits Adams along with Kevin Dyer, Laura Gaydosh Combs and the US Cybersecurity and Infrastructure Security Agency for the coordinated disclosure.

The fix and its limits

Thermo Fisher has released updates that add digital signatures so labs can verify files have not been changed going forward. The company told the Wall Street Journal it knows of no case where the flaw was exploited.

Two further boundaries are worth stating plainly. Physical DNA samples are unaffected: this is a flaw in the digital output files, not in the biology. And three end-of-life product lines will not be patched.

What to sit with

The signatures fix the future. The past is a different matter. The check that catches a forged file did not exist for 30 years of criminal casework, and no method has been found to audit records retroactively.

DNA evidence carries enormous weight in courtrooms precisely because it feels immune to human manipulation. This disclosure does not undo that, but it does raise a question legislatures have not had to answer before: whether digital evidence should require a cryptographic signature by law.