Junglewise Threat Intelligence

CVE-2022-46293: Open Babel out-of-bounds write in MOPAC output parser

CVE-2022-46293 · Severity: high · CVSS 7.8 · Published 2026-07-01

Technologies: openbabel (PyPI), Open Babel. Vendors: PyPI.

Executive brief

Open Babel is a widely used software library for converting and processing chemistry data files. A security flaw in its MOPAC file parser allows a specially crafted chemistry file to crash the application or potentially execute unauthorized code. This risk is present when a user opens a malicious file using the Open Babel command-line tool or any application that integrates the library.

Technical details

An out-of-bounds write vulnerability exists in Open Babel versions up to 3.1.1 within the MOPAC output format parser. The root cause is a failure to validate the number of translation vectors before writing them into a fixed-size 'translationVectors[]' array (typically 3 elements). An attacker can exploit this by providing a malformed MOPAC file containing more vectors than the array can accommodate, leading to memory corruption. While the primary attack vector is local (requiring a user to open a file), the vulnerability can lead to arbitrary code execution or a denial-of-service. The issue was addressed in version 3.2.0 by adding bounds checking to ensure the number of vectors does not exceed the array capacity.

Affected products

  • Open Babel Open Babel <= 3.1.1

Timeline

  • 2023-07-21: disclosed: NVD Published Date
  • 2026-05-26: patched: Version 3.2.0 released
  • 2026-07-01: advisory: GitHub Advisory published

References

Related threats