Executive brief
Open Babel is a widely used software library for processing chemical data and file formats. A vulnerability in its CACAO file parser allows an attacker to crash applications using the library by providing a specially crafted chemistry file. This could lead to a denial-of-service, affecting researchers and automated chemical analysis services that process untrusted data.
Technical details
A NULL pointer dereference exists in the CacaoFormat::SetHilderbrandt function within src/formats/cacaoformat.cpp. The vulnerability is triggered when the parser applies the Hilderbrandt transformation to a malformed CACAO input file that contains invalid internal coordinate references. Specifically, the code assumes all OBAtom pointers in the internal coordinate list are valid; a crafted file can provide null or corrupted pointers, leading to a crash (SEGV) when OBAtom::GetIdx() is called. This affects the obabel CLI tool, the OBConversion API, and all language bindings. The issue is fixed in version 3.2.0.
Affected products
- Open Babel Open Babel <= 3.1.1
Timeline
- 2025-09-14: disclosed: Initial bug report via OSS-Fuzz/GitHub issues
- 2026-05-26: patched: Version 3.2.0 released
- 2026-07-01: advisory: GitHub Advisory published