Executive brief
Open Babel, a widely used library for converting chemical and molecular data files, contains a memory safety vulnerability in its MOPAC file format parser. By providing a specially crafted chemical data file, an attacker could potentially execute malicious code on the system processing the file. This is particularly significant for web-based molecular viewers or conversion services that use this library to handle user-uploaded scientific data.
Technical details
Multiple out-of-bounds write vulnerabilities (CWE-787) exist in Open Babel's translationVectors parsing functionality. Specifically, in the MOPAC format parser's 'Final Point and Derivatives' section, the code fails to properly validate the number of translation vectors being processed against the allocated buffer size. An attacker can exploit this by providing a malformed file with an excessive number of vector entries, leading to a stack-based buffer overflow. This can result in arbitrary code execution. The vulnerability is reachable via the 'obabel' command-line tool or any application using the Open Babel library to parse MOPAC files. A fix is available in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3
Timeline
- 2023-07-21: advisory: Original Talos and GitHub advisories published.
- 2026-07-01: other: Advisory withdrawn as a duplicate of GHSA-7h6r-6p76-68c9.