Executive brief
Open Babel, a chemical toolbox used for processing molecular data, is vulnerable to a memory handling error when processing malformed CIF files. An attacker could provide a specially crafted file that, when opened, causes the application to crash or behave unexpectedly. This could lead to a denial of service, impacting researchers and automated systems that rely on the software for chemical data analysis.
Technical details
An out-of-bounds read vulnerability exists in Open Babel versions prior to 3.2.0 within the `OpenBabel::transform3d::DescribeAsString` function in `src/math/transform3d.cpp`. The root cause is an off-by-one error or incorrect buffer size assumption during the processing of 3D transformation matrices in CIF/mmCIF files. Specifically, while the `SpaceGroup::AddTransform` function allocates 96 bytes (sufficient for 12 double values in a 3x4 matrix), the `DescribeAsString` function attempts to read beyond this limit, likely assuming a 4x4 matrix layout. A remote attacker can exploit this by providing a malformed CIF file, leading to a heap-buffer-overflow and application crash (denial of service). The issue is addressed in version 3.2.0.
Affected products
- Open Babel Project Open Babel < 3.2.0
Timeline
- 2026-02-19: disclosed: Initial disclosure and NVD publication
- 2026-06-30: patched: Version 3.2.0 released and advisory updated