Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 21 July 2023.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open Babel out-of-bounds write in MOPAC translationVectors parsing

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel, a widely used library for converting chemical and molecular data files, contains a memory safety vulnerability in its MOPAC file format parser. By providing a specially crafted chemical data file, an attacker could potentially execute malicious code on the system processing the file. This is particularly significant for web-based molecular viewers or conversion services that use this library to handle user-uploaded scientific data.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 21 July 2023.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple out-of-bounds write vulnerabilities (CWE-787) exist in Open Babel's translationVectors parsing functionality. Specifically, in the MOPAC format parser's 'Final Point and Derivatives' section, the code fails to properly validate the number of translation vectors being processed against the allocated buffer size. An attacker can exploit this by providing a malformed file with an excessive number of vector entries, leading to a stack-based buffer overflow. This can result in arbitrary code execution. The vulnerability is reachable via the 'obabel' command-line tool or any application using the Open Babel library to parse MOPAC files. A fix is available in version 3.2.0.

Affected products

Open Babel Open Babel 3.1.1, master commit 530dbfa3

Timeline

2023-07-21: advisory: Original Talos and GitHub advisories published.
2026-07-01: other: Advisory withdrawn as a duplicate of GHSA-7h6r-6p76-68c9.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.