Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 4.3, published 2 March 2026.
- Which products and versions are affected?
- openbabel (PyPI) < 3.2.0.
- Is there a fix for This vulnerability?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference exists in Open Babel versions up to 3.1.1 within the OBAtom::GetExplicitValence function in src/atom.cpp. The vulnerability is triggered during the parsing of malformed CDXML files via the CDXML File Handler. An attacker can exploit this by providing a crafted file to be processed by the library, leading to an application crash (denial of service). While the attack vector is network-based (remote), it typically requires user interaction to open or process the malicious file. A patch (commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a) is available and the issue is addressed in version 3.2.0.
Affected products
- Open Babel openbabel <= 3.1.1
Timeline
- 2026-03-02: disclosed: Initial disclosure and NVD publication
- 2026-06-30: advisory: GitHub advisory withdrawn as duplicate of GHSA-rxpr-wq63-jr7p