Is CVE-2022-42885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-42885 being exploited in the wild.

How severe is CVE-2022-42885?

High severity, with a CVSS score of 7.8, published 1 July 2026.

Which products and versions are affected?

openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

Is there a fix for CVE-2022-42885?

Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-42885 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2022-42885?

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-42885: Open Babel uninitialized pointer dereference in GRO residue parser

Q: Which products and versions are affected?

openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

Q: Is there a fix for CVE-2022-42885?

Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2022-42885 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2022-42885?

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-42885 · Severity: high · CVSS 7.8 · Published 2026-07-01

Open Babel, a widely used chemistry data conversion library, contains a memory safety flaw in its GRO file format parser. If a user or automated service processes a specially crafted chemistry file, it could lead to a program crash or potentially allow an attacker to execute unauthorized code. This affects researchers and organizations using Open Babel to handle untrusted molecular data files.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-42885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-42885 being exploited in the wild.
How severe is CVE-2022-42885?: High severity, with a CVSS score of 7.8, published 1 July 2026.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2022-42885?: Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-42885 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2022-42885?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openbabel (PyPI): upgrade to 3.2.0 or later
```
pip install "openbabel>=3.2.0"
```

Technical details

A memory-safety vulnerability (CWE-824) exists in Open Babel's GRO reader due to improper residue handling. A malformed record in a GRO file causes the parser to access a residue pointer that has not been initialized. Exploitation requires a victim to open a crafted GRO file using the 'obabel' CLI tool, the OBConversion API, or any of the supported language bindings (Python, Java, etc.). While primarily leading to a denial-of-service (crash), some reports suggest it could potentially lead to arbitrary code execution. The issue is fixed in version 3.2.0.

Affected products

Open Babel Open Babel <= 3.1.1

Identifiers

CVE-2022-42885
GHSA-mw5r-wq2m-397c
PYSEC-2026-2787

Timeline

2026-05-26: patched: Version 3.2.0 released
2026-07-01: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.