Executive brief
Open Babel, a widely used chemistry data software library, contains a memory safety flaw in how it processes certain scientific file formats. If a user opens a specially crafted, malicious chemistry file (such as a Gaussian output file), an attacker could potentially crash the application or execute unauthorized code. This affects researchers and organizations using Open Babel to automate the conversion or analysis of molecular data.
Technical details
An out-of-bounds (OOB) write vulnerability exists in Open Babel's Gaussian reader component. The root cause is the improper handling of periodic-cell translation vectors, which are stored in a fixed-size 'translationVectors[]' array (typically 3 elements). A malformed input file can specify more vectors than the array has slots, leading to a write past the end of the buffer. This is a local attack requiring user interaction (opening a malicious file) and affects the 'obabel' CLI, the 'OBConversion' API, and all language bindings (Python, Java, C#, etc.). The vulnerability was patched in version 3.2.0 by adding bounds checking to ensure the number of vectors does not exceed the array size.
Affected products
- Open Babel Open Babel <= 3.1.1
- pip openbabel < 3.2.0
Timeline
- 2026-05-09: patched: Fix commit 40e85213 authored
- 2026-05-26: patched: Version 3.2.0 released
- 2026-07-01: advisory: GitHub Advisory published
References
- https://github.com/openbabel/openbabel/security/advisories/GHSA-jg3h-pv7c-4f9c
- https://github.com/openbabel/openbabel/commit/40e852138f21d586b7ccdce6329e7b23a87168bb
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1666
- https://api.github.com/repos/openbabel/openbabel/security-advisories/GHSA-jg3h-pv7c-4f9c