Executive brief
Open Babel, a widely used chemistry data toolkit, is vulnerable to a crash when processing specially crafted ChemKin files. If a user or automated service opens a malicious file using this library, the application will terminate unexpectedly. This can lead to a denial-of-service, impacting the availability of research tools and chemistry-related web services.
Technical details
A NULL pointer dereference exists in the ChemKinFormat::ReadReactionQualifierLines function within src/formats/chemkinformat.cpp. The vulnerability is triggered when the parser encounters a malformed reaction qualifier record in a ChemKin file. An attacker can exploit this by providing a crafted file to the obabel CLI tool, the OBConversion API, or any of its language bindings (Python, Java, etc.). Successful exploitation results in a process crash (denial-of-service). The issue was identified via OSS-Fuzz and is addressed in version 3.2.0.
Affected products
- Open Babel openbabel <= 3.1.1
Timeline
- 2025-09-14: other: Issue reported on GitHub
- 2026-05-26: patched: Version 3.2.0 released
- 2026-07-01: advisory: GitHub Advisory published