Executive brief
Open Babel is a widely used chemistry software library for converting between various molecular file formats. A vulnerability in its MOPAC output parser allows a specially crafted file to cause a memory error. If a user or automated service processes a malicious file, it could lead to a program crash or potentially allow an attacker to execute unauthorized code.
Technical details
An out-of-bounds (OOB) write vulnerability exists in Open Babel's MOPAC output reader. The root cause is a failure to validate the number of translation vectors in the 'UNIT CELL TRANSLATION' block before writing them into a fixed-size stack array named 'translationVectors[]'. By providing a malformed MOPAC file containing more vectors than the array can accommodate, an attacker can trigger a write past the buffer boundary. This can be exploited via the 'obabel' CLI tool, the 'OBConversion' API, or any of the library's language bindings (Python, Ruby, Java, etc.). The vulnerability was patched in version 3.2.0 by adding bounds checking to ensure the number of vectors does not exceed the array capacity.
Affected products
- Open Babel Open Babel <= 3.1.1
- Open Babel openbabel (pip) < 3.2.0
Timeline
- 2022-12-05: disclosed: Vulnerability reported by Cisco Talos
- 2026-05-26: patched: Version 3.2.0 released
- 2026-07-06: advisory: GitHub Advisory published
References
- https://github.com/openbabel/openbabel/security/advisories/GHSA-55f6-pf8r-c2f4
- https://github.com/openbabel/openbabel/commit/40e852138f21d586b7ccdce6329e7b23a87168bb
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1666
- https://api.github.com/repos/openbabel/openbabel/security-advisories/GHSA-55f6-pf8r-c2f4