Executive brief
Open Babel, a chemical toolbox used to search, convert, and analyze data from molecular modeling and chemistry, is vulnerable to a crash when processing certain chemical data files. By providing a specially crafted CDXML file, an attacker could cause the software to crash, leading to a denial of service. This could disrupt laboratory workflows or automated chemical data processing pipelines.
Technical details
A NULL pointer dereference exists in Open Babel versions up to 3.1.1 within the OBAtom::GetExplicitValence function in src/atom.cpp. The vulnerability is triggered during the parsing of malformed CDXML files via the CDXML File Handler. An attacker can exploit this by providing a crafted file to be processed by the library, leading to an application crash (denial of service). While the attack vector is network-based (remote), it typically requires user interaction to open or process the malicious file. A patch (commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a) is available and the issue is addressed in version 3.2.0.
Affected products
- Open Babel openbabel <= 3.1.1
Timeline
- 2026-03-02: disclosed: Initial disclosure and NVD publication
- 2026-06-30: advisory: GitHub advisory withdrawn as duplicate of GHSA-rxpr-wq63-jr7p