Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Critical severity, with a CVSS score of 9.8, published 21 July 2023.
- Which products and versions are affected?
- openbabel (PyPI) < 3.2.0.
- Is there a fix for This vulnerability?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Multiple out-of-bounds (OOB) write vulnerabilities exist in the translationVectors parsing logic across several file format parsers in Open Babel, including MSI, MOPAC, and Gaussian. The root cause is a failure to validate the number of translation vectors read from an input file against the fixed-size 'translationVectors' array (typically size 3) on the stack. An attacker can provide a malformed file with excessive vector entries to overflow the stack buffer, potentially leading to arbitrary code execution. The vulnerability is reachable via the 'obabel' command-line tool or any application using the Open Babel library to parse untrusted chemical data files. The issue was addressed in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3
Timeline
- 2023-07-21: advisory: Original Talos and GitHub advisories published
- 2026-07-01: other: Advisory GHSA-83c5-hghm-jg6r withdrawn as a duplicate of GHSA-f8h2-c479-vqxf