Executive brief
Open Babel, a widely used library for converting chemical data formats, contains a security flaw in how it processes MOL2 files. By providing a specially crafted file to a system using this library—such as an online molecule viewer or data converter—an attacker could potentially take control of the system or cause it to crash. This could lead to unauthorized access to sensitive research data or disruption of scientific services.
Technical details
An out-of-bounds write vulnerability exists in Open Babel's MOL2 format parser within the `ReadMolecule` function in `formats/mol2format.cpp`. The vulnerability is caused by the use of `sscanf` with a `%s` format specifier to read attributes and values into fixed-size 32-byte stack buffers (`attr` and `val`) without length constraints. An attacker can exploit this by providing a malformed MOL2 file containing long strings in the attribute/value section, leading to a stack-based buffer overflow. While exploitation requires the 'c' option to be enabled during conversion, the library's use in networked backend services makes it a viable target for remote code execution. The issue is addressed in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3, and all versions prior to 3.2.0
Timeline
- 2022-10-24: disclosed: Initial discovery/report by Talos (TALOS-2022-1664)
- 2023-07-21: advisory: Original advisory published
- 2026-07-01: other: Advisory withdrawn as a duplicate of GHSA-vjg6-gm8m-v5g6