Executive brief
Open Babel, a widely used library for converting chemistry and molecular data files, contains a memory safety flaw in its PQS file format parser. An attacker could provide a specially crafted, malicious chemistry file that, when opened by a user or processed by a service using this library, could lead to unauthorized code execution or system crashes. This affects researchers and organizations using Open Babel for molecular modeling or chemical data analysis.
Technical details
An out-of-bounds write vulnerability exists in Open Babel's PQS format parser within the `coord_file` parsing logic in `formats/PQSformat.cpp`. The flaw is triggered when the parser encounters a malformed coordinate file specifier, leading to a buffer overflow as data is written past the end of a destination buffer (specifically involving unsafe `strcat` operations). While the NVD/GitHub CVSS reflects a local attack vector requiring user interaction (opening a file), the library is often embedded in web-based chemical converters, potentially extending the impact. The vulnerability was addressed in version 3.2.0 by replacing unsafe string operations with bounded alternatives like `strncat`.
Affected products
- Open Babel Open Babel <= 3.1.1
Timeline
- 2023-07-21: disclosed: Initial Talos report published
- 2026-05-26: patched: Version 3.2.0 released
- 2026-07-01: advisory: GitHub Advisory published
References
- https://github.com/openbabel/openbabel/security/advisories/GHSA-f29h-2h58-48r7
- https://github.com/openbabel/openbabel/commit/2a7d2cda8bd47daade2e555e34b69651a2e132ef
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1671
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1671
- https://api.github.com/repos/openbabel/openbabel/security-advisories/GHSA-f29h-2h58-48r7