Junglewise Threat Intelligence

Open Babel out-of-bounds write in translationVectors parsing

Severity: critical · CVSS 9.8 · Published 2023-07-21

Technologies: Open Babel, openbabel (PyPI). Vendors: PyPI.

Executive brief

Open Babel, a widely used library for converting chemical file formats, contains a critical memory handling flaw. By providing a specially crafted chemical data file (such as Gaussian or MSI formats), an attacker can cause the software to crash or execute unauthorized code. This is particularly significant for web-based chemical converters or molecule viewers that use this library to process user-uploaded files.

Technical details

Multiple out-of-bounds (OOB) write vulnerabilities exist in the translationVectors parsing logic across several file format parsers in Open Babel, including MSI, MOPAC, and Gaussian. The root cause is a failure to validate the number of translation vectors read from an input file against the fixed-size 'translationVectors' array (typically size 3) on the stack. An attacker can provide a malformed file with excessive vector entries to overflow the stack buffer, potentially leading to arbitrary code execution. The vulnerability is reachable via the 'obabel' command-line tool or any application using the Open Babel library to parse untrusted chemical data files. The issue was addressed in version 3.2.0.

Affected products

  • Open Babel Open Babel 3.1.1, master commit 530dbfa3

Timeline

  • 2023-07-21: advisory: Original Talos and GitHub advisories published
  • 2026-07-01: other: Advisory GHSA-83c5-hghm-jg6r withdrawn as a duplicate of GHSA-f8h2-c479-vqxf

References

Related threats