Executive brief
Open Babel, a widely used library for converting chemical and molecular data files, contains a security flaw in how it processes certain file formats. By providing a specially crafted, malicious file to a system using this library, an attacker could potentially take full control of the affected system. This risk is particularly relevant for web-based chemical converters or research tools that allow users to upload and view molecular structures.
Technical details
Multiple out-of-bounds write vulnerabilities (CWE-787, CWE-119) exist in Open Babel's parsing logic for several chemical file formats, including MOPAC (Unit Cell Translation section), MSI (PeriodicType), MOPAC Cartesian, and Gaussian. The root cause is a failure to validate the number of translation vectors read from an input file against the fixed-size 'translationVectors' stack array (typically size 3). An attacker can provide a malformed file with an excessive number of vector entries to overflow the stack buffer, potentially leading to arbitrary code execution. While the attack vector is local file processing, the library is often used in network-accessible backend services, justifying a high CVSS score. The issue is resolved in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3, all versions before 3.2.0
Timeline
- 2023-07-21: advisory: Original Talos and GitHub advisories published
- 2026-07-06: patched: Advisory updated to reflect patched status in 3.2.0 and withdrawn as duplicate of GHSA-55f6-pf8r-c2f4