Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 3.3, published 26 September 2025.
- Which products and versions are affected?
- openbabel (PyPI) < 3.2.0.
- Is there a fix for This vulnerability?
- A patch was published on 2026-07-01: Version 3.2.0 identified as patched version in withdrawn duplicate advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked with local access, in a software library.
- Am I affected?
- Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference exists in the ChemKinFormat::ReadReactionQualifierLines function within src/formats/chemkinformat.cpp of Open Babel. The vulnerability is triggered when the parser assumes a non-null string while calling c_str() during token comparison of malformed ChemKin input. An attacker with local access can provide a crafted file to trigger a segmentation fault (SEGV), resulting in a denial-of-service. This issue was identified via fuzzing and is addressed in version 3.2.0.
Affected products
- Open Babel Open Babel < 3.2.0
Timeline
- 2025-09-14: disclosed: Issue reported on GitHub with PoC
- 2025-09-26: advisory: Initial GHSA and NVD publication
- 2026-07-01: patched: Version 3.2.0 identified as patched version in withdrawn duplicate advisory