Executive brief
Open Babel, a widely used library for converting chemical file formats, contains a critical security flaw in how it processes certain data files. By providing a specially crafted file (such as MSI, MOPAC, or Gaussian formats), an attacker could potentially execute malicious code on the system running the software. This is particularly significant for web-based chemical converters or molecule viewers that use this library to process user-uploaded files.
Technical details
Multiple out-of-bounds write vulnerabilities (CWE-787, CWE-119) exist in Open Babel 3.1.1 and master commit 530dbfa3 within the translationVectors parsing logic. The vulnerability occurs in the ReadMolecule function across several formats, including MSI, MOPAC, MOPAC Cartesian, and Gaussian. Specifically, the code fails to validate the number of translation vectors read from a file against the fixed-size 'translationVectors' array (typically size 3), allowing an attacker to increment the index and write controlled coordinate data (x, y, z) past the buffer's boundary on the stack. While the attack vector is technically local (file parsing), the library's common use in network-accessible backend conversion services elevates the risk to remote code execution. The issue is addressed in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3
Timeline
- 2023-07-21: advisory: Initial advisory published by Talos and GitHub
- 2026-07-01: other: Advisory GHSA-v5fw-q4pf-8p2h withdrawn as a duplicate of GHSA-jg3h-pv7c-4f9c