Junglewise Threat Intelligence

CVE-2022-46289: Open Babel out-of-bounds write in ORCA nAtoms parser

CVE-2022-46289 · Severity: high · CVSS 7.8 · Published 2026-07-01

Technologies: openbabel (PyPI), Open Babel. Vendors: PyPI.

Executive brief

Open Babel, a widely used library for converting chemistry file formats, contains a memory safety flaw in its ORCA file parser. If a user opens a specially crafted, malicious ORCA file using an application or service powered by Open Babel, an attacker could potentially execute arbitrary code or cause the application to crash. This affects various platforms and programming languages that use the library, including Python, Java, and C#.

Technical details

An out-of-bounds write vulnerability (CWE-787/CWE-122) exists in Open Babel's ORCA parser within the `OrcaOutputFormat::ReadMolecule` function in `formats/orcaformat.cpp`. The vulnerability is triggered when the parser encounters a 'Number of atoms' line in a malformed ORCA file; the `nAtoms` value is extracted via `atoi` and used to manage memory operations without sufficient validation, leading to a heap-based buffer overflow. While the NVD lists a local vector requiring user interaction (AV:L/UI:R), the library's use in web-based chemistry converters may present a remote attack surface. The issue is fixed in version 3.2.0.

Affected products

  • Open Babel Open Babel All versions up to and including 3.1.1; master commit 530dbfa3

Timeline

  • 2023-07-21: disclosed: Initial report by Cisco Talos
  • 2026-05-26: patched: Version 3.2.0 released
  • 2026-07-01: advisory: GitHub Advisory published

References

Related threats