Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 19 February 2026.

Which products and versions are affected?

openbabel (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0.

Is there a fix for This vulnerability?

Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open Babel out-of-bounds read in MOL2 file handler

Severity: low · CVSS 3.1 · Published 2026-02-19

Open Babel is a chemistry software library used to convert and manipulate molecular structure files. A flaw in how it parses MOL2 files can cause the application to read memory beyond allocated buffer boundaries, leading to application crashes or potential information disclosure. This affects any system that processes untrusted MOL2 files with Open Babel.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 19 February 2026.
Which products and versions are affected?: openbabel (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.0.
Is there a fix for This vulnerability?: Yes. openbabel (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openbabel (PyPI): upgrade to 3.2.0 or later
```
pip install "openbabel>=3.2.0"
```

Technical details

The vulnerability is an out-of-bounds read (CWE-125) in the OBAtom::SetFormalCharge function within the MOL2 file handler component of Open Babel. The root cause is a buffer overread in the transform3d::DescribeAsString function when processing specially crafted CIF/MMCIF files with malformed Space Group definitions. An attacker can trigger this by providing a malicious MOL2/CIF file to Open Babel, which does not require authentication or special privileges. The crash is reproducible remotely and the exploit has been made public. The vulnerability affects Open Babel versions up to 3.1.1 and is fixed in version 3.2.0.

Affected products

Open Babel Open Babel up to 3.1.1

Timeline

2026-02-19: disclosed
2026-02-19: advisory: Advisory published by GitHub advisory database
2026: patched: Fixed in version 3.2.0

References

https://github.com/openbabel/openbabel/issues/2848

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.