Executive brief
Open Babel, a chemical toolbox used to process molecular data, is vulnerable to a memory handling error when processing specially crafted MOL2 files. An attacker could provide a malicious file to a user or service, causing the application to crash. This results in a denial-of-service, potentially disrupting scientific research or automated chemical analysis workflows.
Technical details
An out-of-bounds read vulnerability exists in Open Babel versions up to 3.1.1 within the MOL2 File Handler. The flaw is located in the OBAtom::SetFormalCharge function in include/openbabel/atom.h. The vulnerability is triggered when the library parses a malformed MOL2 file, leading to a memory access violation. While some reports suggest a NULL pointer dereference, the primary mechanism is an out-of-bounds read that can be exploited remotely if a user is induced to open a malicious file. A patch has been identified in commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a and is included in version 3.2.0.
Affected products
- Open Babel Project Open Babel <= 3.1.1
Timeline
- 2026-02-19: advisory: Initial disclosure via GitHub Advisory and NVD
- 2026-06-30: patched: Version 3.2.0 released to address the issue