CVE-2025-10994: Open Babel use-after-free in GAMESSOutputFormat::ReadMolecule

CVE-2025-10994 · Severity: high · CVSS 7.8 · Published 2026-06-30

Open Babel, a widely used chemistry data toolkit, contains a memory safety flaw in its GAMESS file parser. If a user or automated service processes a specially crafted chemistry file, it could lead to a program crash or potentially allow an attacker to execute unauthorized code. This affects researchers and organizations using the software to convert or analyze molecular data.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-10994 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-10994 being exploited in the wild.
How severe is CVE-2025-10994?
High severity, with a CVSS score of 7.8, published 30 June 2026.
Which products and versions are affected?
openbabel (PyPI) < 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2025-10994?
Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-10994 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-10994?
Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openbabel (PyPI): upgrade to 3.2.0 or later
    pip install "openbabel>=3.2.0"

Technical details

A use-after-free vulnerability exists in the `GAMESSOutputFormat::ReadMolecule` function within `gamessformat.cpp`. The flaw is triggered when parsing a malformed GAMESS output file, causing the parser to dereference a stale pointer after the underlying memory object has been freed. An attacker can exploit this by providing a crafted input file to the `obabel` CLI tool, the `OBConversion` API, or any of its language bindings (Python, Java, etc.). Successful exploitation could lead to memory corruption, application crashes, or remote code execution in the context of the application. The issue was identified via OSS-Fuzz and is resolved in version 3.2.0.

Affected products

  • Open Babel Open Babel <= 3.1.1

Identifiers

  • CVE-2025-10994
  • GHSA-pp85-5j63-xpq3
  • PYSEC-2026-2789

Timeline

  • 2025-09-14: disclosed: Initial bug report on GitHub issue tracker
  • 2026-05-26: patched: Version 3.2.0 released with fix
  • 2026-06-30: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.