Executive brief
Open Babel, a widely used library for converting chemical data formats, contains a security flaw in how it handles molecule titles when saving files in the CSR format. An attacker could provide a specially crafted chemical file that, when processed by the software, allows for unauthorized code execution. This could lead to a complete system takeover, especially in web-based chemical viewers or converters that use this library to process user-uploaded data.
Technical details
An out-of-bounds (OOB) write vulnerability exists in Open Babel versions prior to 3.2.0 within the CSR format's title processing logic. The flaw is located in the `CSRFormat::PadString` function in `formats/CSRformat.cpp`, where a `strncpy` operation uses the length of the input title as the copy limit rather than the size of the destination buffer (fixed at 80 bytes). By providing a molecule with a title longer than 80 characters, an attacker can trigger a heap-based buffer overflow. This can be exploited via the `obabel` command-line tool or any application using the library to convert files to the CSR format, potentially leading to arbitrary code execution. The vulnerability is reachable over the network if the library is used in backend web services for chemical format conversion.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3, all versions before 3.2.0
Timeline
- 2023-07-21: advisory: Initial advisory published by Talos and GitHub
- 2026-07-01: other: Advisory GHSA-jmf7-79p7-qchq withdrawn as a duplicate of GHSA-p594-7xw4-g76p