Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 21 July 2023.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open Babel out-of-bounds write in ORCA nAtoms parser

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel is a widely used chemical toolbox designed to speak many languages of chemical data. A vulnerability in its ORCA file format parser allows an attacker to execute malicious code by providing a specially crafted chemical data file. This could lead to a complete system takeover, data theft, or service disruption, especially for web-based molecule viewers or conversion services that use this library in their backend.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 21 July 2023.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality within 'formats/orcaformat.cpp'. The root cause is an integer wrap-around during the calculation of 'nAtoms * 3' when allocating the 'confCoords' buffer. An attacker can provide a malformed ORCA file with a large 'nAtoms' value (e.g., 1431655766), causing a small heap buffer allocation followed by an out-of-bounds write of coordinate data. This can be triggered via the 'obabel' command-line tool or any application using the Open Babel library to parse ORCA files. Successful exploitation can lead to arbitrary code execution. The issue is addressed in version 3.2.0.

Affected products

Open Babel Open Babel 3.1.1, master commit 530dbfa3

Timeline

2023-07-21: advisory: Original Talos and GitHub advisories published
2026-07-01: other: Advisory GHSA-g8f4-g673-rfw2 withdrawn as a duplicate of GHSA-rj4c-r689-cm87

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.