Executive brief
Open Babel is a widely used chemical toolbox designed to speak many languages of chemical data. A vulnerability in its ORCA file format parser allows an attacker to execute malicious code by providing a specially crafted chemical data file. This could lead to a complete system takeover, data theft, or service disruption, especially for web-based molecule viewers or conversion services that use this library in their backend.
Technical details
Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality within 'formats/orcaformat.cpp'. The root cause is an integer wrap-around during the calculation of 'nAtoms * 3' when allocating the 'confCoords' buffer. An attacker can provide a malformed ORCA file with a large 'nAtoms' value (e.g., 1431655766), causing a small heap buffer allocation followed by an out-of-bounds write of coordinate data. This can be triggered via the 'obabel' command-line tool or any application using the Open Babel library to parse ORCA files. Successful exploitation can lead to arbitrary code execution. The issue is addressed in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3
Timeline
- 2023-07-21: advisory: Original Talos and GitHub advisories published
- 2026-07-01: other: Advisory GHSA-g8f4-g673-rfw2 withdrawn as a duplicate of GHSA-rj4c-r689-cm87