Is CVE-2022-46280 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-46280 being exploited in the wild.

How severe is CVE-2022-46280?

High severity, with a CVSS score of 7.8, published 1 July 2026.

Which products and versions are affected?

openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

Is there a fix for CVE-2022-46280?

Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-46280 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2022-46280?

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-46280: Open Babel uninitialized pointer dereference in PQS parser

Q: Which products and versions are affected?

openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.

Q: Is there a fix for CVE-2022-46280?

Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2022-46280 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2022-46280?

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-46280 · Severity: high · CVSS 7.8 · Published 2026-07-01

Open Babel, a widely used library for converting chemical and molecular data formats, contains a memory safety flaw in its PQS file parser. An attacker could provide a specially crafted PQS file that, when opened by a user or processed by a service using this library, could lead to a program crash or potentially allow the execution of unauthorized code. This affects researchers and organizations using Open Babel for chemistry data analysis or web-based molecule viewers.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-46280 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-46280 being exploited in the wild.
How severe is CVE-2022-46280?: High severity, with a CVSS score of 7.8, published 1 July 2026.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2022-46280?: Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-46280 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2022-46280?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openbabel (PyPI): upgrade to 3.2.0 or later
```
pip install "openbabel>=3.2.0"
```

Technical details

A memory-safety vulnerability exists in Open Babel's PQS parser due to an uninitialized pointer dereference in the `pFormat` handling of the PQS reader. The flaw occurs within `PQSFormat::ReadMolecule` in `formats/PQSformat.cpp` when processing malformed input that causes the parser to access a format pointer before it has been properly initialized. An attacker can exploit this by providing a crafted PQS file to be processed via the `obabel` CLI tool, the `OBConversion` API, or any of the library's language bindings (Python, Ruby, Java, etc.). Successful exploitation could lead to arbitrary code execution or a crash. The issue is addressed in version 3.2.0 by ensuring the pointer is initialized to `nullptr` and verified before use.

Affected products

Open Babel Open Babel Up to and including 3.1.1

Identifiers

CVE-2022-46280
GHSA-8qxc-57hf-hc9j
PYSEC-2026-2777

Timeline

2023-07-21: disclosed: Initial Talos report published
2026-05-26: patched: Version 3.2.0 released
2026-07-01: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.