# Open Babel out-of-bounds write in Gaussian orientation parser

Source: https://junglewise.ai/threats/open-babel-out-of-bounds-write-in-gaussian-orientation-parser-ea5cd10a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-21. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.3 · Published 2023-07-21

Open Babel is a widely used software library for converting and viewing chemical data files. A security flaw in how it processes certain scientific file formats (Gaussian) allows an attacker to crash the software or potentially take control of the system by providing a specially crafted, malicious file. This is particularly significant for organizations running web-based chemical converters or molecular modeling tools that use this library to process user-uploaded data.

Technologies: [openbabel (PyPI)](https://junglewise.ai/threats/technologies/openbabel). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.3, published 21 July 2023.

**Which products and versions are affected?** openbabel (PyPI) < 3.2.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in Open Babel's Gaussian format orientation functionality within 'formats/gaussformat.cpp'. The root cause is located in the 'ReadMolecule' function, where a fixed-size stack buffer ('coords_type' of 25 bytes) is used to store tokens from the input file. The code uses 'strncpy' to copy up to 24 bytes into this buffer and subsequently uses 'strcat' to append a 13-character fixed string (' orientation:'), resulting in a stack-based buffer overflow. An attacker can exploit this by providing a malformed Gaussian file to a service or application using Open Babel (such as the 'obabel' CLI tool). This can lead to memory corruption and arbitrary code execution. The vulnerability is addressed in version 3.2.0.

## Affected products

- Open Babel Open Babel 3.1.1, master commit 530dbfa3, and all versions prior to 3.2.0

## Timeline

- 2023-07-21: disclosed: Initial advisory publication
- 2023-07-21: advisory: Talos vulnerability report TALOS-2022-1672 published
- 2026-07-01: other: Advisory withdrawn as a duplicate of GHSA-vr3p-gg26-45v9

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2022-1672](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1672)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1672](https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1672)

## Related threats

- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46292-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in MSI parser translationVectors](https://junglewise.ai/threats/cve-2022-46295-open-babel-out-of-bounds-write-in-msi-parser-translationvectors)
- [Open Babel out-of-bounds write in MOPAC input parser](https://junglewise.ai/threats/cve-2022-46294-open-babel-out-of-bounds-write-in-mopac-input-parser)
- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46293-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in Gaussian translationVectors](https://junglewise.ai/threats/cve-2022-46291-open-babel-out-of-bounds-write-in-gaussian-translationvectors)