CVE-2022-46289: Open Babel out-of-bounds write in ORCA nAtoms parser

CVE-2022-46289 · Severity: high · CVSS 7.8 · Published 2026-07-01

Open Babel, a widely used library for converting chemistry file formats, contains a memory safety flaw in its ORCA file parser. If a user opens a specially crafted, malicious ORCA file using an application or service powered by Open Babel, an attacker could potentially execute arbitrary code or cause the application to crash. This affects various platforms and programming languages that use the library, including Python, Java, and C#.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-46289 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-46289 being exploited in the wild.
How severe is CVE-2022-46289?
High severity, with a CVSS score of 7.8, published 1 July 2026.
Which products and versions are affected?
openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2022-46289?
Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-46289 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2022-46289?
Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openbabel (PyPI): upgrade to 3.2.0 or later
    pip install "openbabel>=3.2.0"

Technical details

An out-of-bounds write vulnerability (CWE-787/CWE-122) exists in Open Babel's ORCA parser within the `OrcaOutputFormat::ReadMolecule` function in `formats/orcaformat.cpp`. The vulnerability is triggered when the parser encounters a 'Number of atoms' line in a malformed ORCA file; the `nAtoms` value is extracted via `atoi` and used to manage memory operations without sufficient validation, leading to a heap-based buffer overflow. While the NVD lists a local vector requiring user interaction (AV:L/UI:R), the library's use in web-based chemistry converters may present a remote attack surface. The issue is fixed in version 3.2.0.

Affected products

  • Open Babel Open Babel All versions up to and including 3.1.1; master commit 530dbfa3

Identifiers

  • CVE-2022-46289
  • GHSA-rj4c-r689-cm87
  • PYSEC-2026-2790

Timeline

  • 2023-07-21: disclosed: Initial report by Cisco Talos
  • 2026-05-26: patched: Version 3.2.0 released
  • 2026-07-01: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.