CVE-2026-2704: Open Babel out-of-bounds read in CIF File Handler

Executive brief

Open Babel, a widely used library for processing chemical data, contains a flaw in how it reads certain chemistry file formats (CIF). An attacker could create a specially crafted file that, when opened by a user or processed by a service, causes the application to crash or potentially leak small amounts of memory. This could disrupt scientific workflows or affect services that automatically process chemical data uploaded by users.

Technical details

An out-of-bounds read vulnerability exists in Open Babel's CIF file format parser within the 'OpenBabel::transform3d::DescribeAsString' function. The root cause is a failure to properly validate the length of symmetry-operation strings, leading the parser to read past the end of an internal buffer during description formatting. An attacker can exploit this by providing a malformed CIF file to the 'obabel' CLI tool, the OBConversion API, or associated language bindings. Successful exploitation requires user interaction (opening the file) and can result in a denial-of-service (crash) or limited information disclosure. The issue is addressed in version 3.2.0.

Affected products

• Open Babel openbabel <= 3.1.1

Timeline

• 2026-05-26: patched: Version 3.2.0 released
• 2026-06-30: disclosed: GitHub Advisory published

References

• https://api.github.com/users/VedantMadane
• https://github.com/VedantMadane
• https://api.github.com/users/VedantMadane/gists%7B/gist_id%7D
• https://api.github.com/users/VedantMadane/repos
• https://avatars.githubusercontent.com/u/6527493?v=4
• https://api.github.com/users/VedantMadane/events%7B/privacy%7D