Executive brief
Open Babel is a widely used software library for converting and processing chemistry data files. A security flaw in its MOPAC file parser allows a specially crafted chemistry file to crash the application or potentially execute unauthorized code. This risk is present when a user opens a malicious file using the Open Babel command-line tool or any application that integrates the library.
Technical details
An out-of-bounds write vulnerability exists in Open Babel versions up to 3.1.1 within the MOPAC output format parser. The root cause is a failure to validate the number of translation vectors before writing them into a fixed-size 'translationVectors[]' array (typically 3 elements). An attacker can exploit this by providing a malformed MOPAC file containing more vectors than the array can accommodate, leading to memory corruption. While the primary attack vector is local (requiring a user to open a file), the vulnerability can lead to arbitrary code execution or a denial-of-service. The issue was addressed in version 3.2.0 by adding bounds checking to ensure the number of vectors does not exceed the array capacity.
Affected products
- Open Babel Open Babel <= 3.1.1
Timeline
- 2023-07-21: disclosed: NVD Published Date
- 2026-05-26: patched: Version 3.2.0 released
- 2026-07-01: advisory: GitHub Advisory published
References
- https://github.com/openbabel/openbabel/security/advisories/GHSA-7h6r-6p76-68c9
- https://github.com/openbabel/openbabel/commit/40e852138f21d586b7ccdce6329e7b23a87168bb
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1666
- https://api.github.com/repos/openbabel/openbabel/security-advisories/GHSA-7h6r-6p76-68c9