CVE-2026-2705: Open Babel NULL pointer dereference in MOL2 OBAtom::SetFormalCharge

Executive brief

Open Babel is a software library used to process and convert chemistry data files. A vulnerability in its file parser allows a specially crafted chemistry file to crash the application. This could lead to a service outage or application failure if a user or automated system attempts to process a malicious file.

Technical details

A memory-safety vulnerability exists in Open Babel's MOL2 file format parser due to a NULL pointer dereference in the `OBAtom::SetFormalCharge` function. The flaw is triggered when the parser encounters a malformed atom record in a MOL2 file, causing it to call the method on a NULL atom pointer. An attacker can exploit this by providing a crafted MOL2 file to the `obabel` CLI tool, the `OBConversion` API, or any of its language bindings (Python, Java, etc.). This results in a denial-of-service (application crash). The issue is fixed in version 3.2.0.

Affected products

• Open Babel openbabel <= 3.1.1

Timeline

• 2026-05-26: patched: Version 3.2.0 released
• 2026-06-30: advisory: GitHub Advisory published

References

• https://api.github.com/users/VedantMadane
• https://github.com/VedantMadane
• https://api.github.com/users/VedantMadane/gists%7B/gist_id%7D
• https://api.github.com/users/VedantMadane/repos
• https://avatars.githubusercontent.com/u/6527493?v=4
• https://api.github.com/users/VedantMadane/events%7B/privacy%7D