CVE-2026-3408: Open Babel NULL pointer dereference in CDXML OBAtom::GetExplicitValence

Executive brief

Open Babel, a widely used library for processing chemical data files, contains a flaw in how it handles certain file formats. An attacker could create a specially crafted chemical data file (CDXML) that, when opened by a user or processed by a service, causes the application to crash. This could lead to a denial of service, impacting the availability of research tools or automated chemistry services.

Technical details

A NULL pointer dereference exists in Open Babel's CDXML file format parser within the `OBAtom::GetExplicitValence` method. The vulnerability is triggered when the parser encounters a malformed fragment in a CDXML file, causing it to invoke the method on a NULL atom pointer. Exploitation requires a victim to open a malicious CDXML file using the `obabel` CLI tool, the `OBConversion` API, or any of its language bindings (e.g., Python, Java, C#). The issue is fixed in version 3.2.0.

Affected products

• Open Babel openbabel <= 3.1.1

Timeline

• 2026-05-26: patched: Version 3.2.0 released
• 2026-05-27: advisory: Initial GitHub Advisory published
• 2026-06-30: disclosed: Full advisory details published/updated

References

• https://api.github.com/users/VedantMadane
• https://github.com/VedantMadane
• https://api.github.com/users/VedantMadane/gists%7B/gist_id%7D
• https://api.github.com/users/VedantMadane/repos
• https://avatars.githubusercontent.com/u/6527493?v=4
• https://api.github.com/users/VedantMadane/events%7B/privacy%7D