Russia, France, Iraq and North Korea have samples of smallpox, according to the officials.
The Washington Post reported that the information came from classified US intelligence briefings.
Smallpox
Has existed for 3,000 years
Spreads through the air
Fatal in up to 30% of cases
No known cure
Vaccination before exposure or 2-3 days after offers almost complete protection
Vaccination 4-5 days after exposure may prevent death
US stopped routine vaccination in 1972
Adults vaccinated as children may no longer be protected
Vaccine can have serious side effects
Sources: CDC and WHO
The officials also said Osama Bin Laden's al-Qaeda network had tried to obtain the virus and other biological weapons, but that it was unlikely it had the capability to mount an attack with smallpox.
The two assessments are thought to have contributed to US plans for mass vaccination against the disease, which kills up to 30% of its victims.
Iraq and North Korea have both been named by US President George W Bush as part of an "axis of evil", and there are fears that both could develop powerful biological weapons using these samples.
There are also concerns that poor security in Russia could allow other nations or terrorist organisations to obtain smallpox.
Undeclared samples
Smallpox seed cultures are currently officially maintained in just two laboratories - in Atlanta in the US state of Georgia and Koltsovo, Siberia.
The US renounced germ warfare in 1969 has not developed any known offensive programme since.
But the CIA's Weapons Intelligence, Non-proliferation and Arms Control Center now believes that four nations, including Russia, have undeclared samples of the virus.
Vaccine stockpile
In July, the US announced a plan to vaccinate 500,000 emergency and health workers.
The vaccine has been produced rapidly and stockpiled since the 11 September attacks on New York and Washington last year.
There are also fears that an attack on Iraq could lead to retaliation using biological weapons.