CVE-2022-46292: Open Babel out-of-bounds write in MOPAC output parser

CVE-2022-46292 · Severity: high · CVSS 7.8 · Published 2026-07-06

Open Babel is a widely used chemistry software library for converting between various molecular file formats. A vulnerability in its MOPAC output parser allows a specially crafted file to cause a memory error. If a user or automated service processes a malicious file, it could lead to a program crash or potentially allow an attacker to execute unauthorized code.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-46292 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-46292 being exploited in the wild.
How severe is CVE-2022-46292?
High severity, with a CVSS score of 7.8, published 6 July 2026.
Which products and versions are affected?
openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2022-46292?
Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-46292 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2022-46292?
Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openbabel (PyPI): upgrade to 3.2.0 or later
    pip install "openbabel>=3.2.0"

Technical details

An out-of-bounds (OOB) write vulnerability exists in Open Babel's MOPAC output reader. The root cause is a failure to validate the number of translation vectors in the 'UNIT CELL TRANSLATION' block before writing them into a fixed-size stack array named 'translationVectors[]'. By providing a malformed MOPAC file containing more vectors than the array can accommodate, an attacker can trigger a write past the buffer boundary. This can be exploited via the 'obabel' CLI tool, the 'OBConversion' API, or any of the library's language bindings (Python, Ruby, Java, etc.). The vulnerability was patched in version 3.2.0 by adding bounds checking to ensure the number of vectors does not exceed the array capacity.

Affected products

  • Open Babel Open Babel <= 3.1.1
  • Open Babel openbabel (pip) < 3.2.0

Identifiers

  • CVE-2022-46292
  • GHSA-55f6-pf8r-c2f4
  • PYSEC-2026-2771

Timeline

  • 2022-12-05: disclosed: Vulnerability reported by Cisco Talos
  • 2026-05-26: patched: Version 3.2.0 released
  • 2026-07-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.