# Open Babel out-of-bounds write in translationVectors parsing

Source: https://junglewise.ai/threats/open-babel-out-of-bounds-write-in-translationvectors-parsing-54d175ce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-21. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel, a widely used library for converting chemical file formats, contains a critical security flaw in how it processes certain data files. By providing a specially crafted file (such as MSI, MOPAC, or Gaussian formats), an attacker could potentially execute malicious code on the system running the software. This is particularly significant for web-based chemical converters or molecule viewers that use this library to process user-uploaded files.

Technologies: [openbabel (PyPI)](https://junglewise.ai/threats/technologies/openbabel). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.8, published 21 July 2023.

**Which products and versions are affected?** openbabel (PyPI) < 3.2.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected?** Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple out-of-bounds write vulnerabilities (CWE-787, CWE-119) exist in Open Babel 3.1.1 and master commit 530dbfa3 within the translationVectors parsing logic. The vulnerability occurs in the ReadMolecule function across several formats, including MSI, MOPAC, MOPAC Cartesian, and Gaussian. Specifically, the code fails to validate the number of translation vectors read from a file against the fixed-size 'translationVectors' array (typically size 3), allowing an attacker to increment the index and write controlled coordinate data (x, y, z) past the buffer's boundary on the stack. While the attack vector is technically local (file parsing), the library's common use in network-accessible backend conversion services elevates the risk to remote code execution. The issue is addressed in version 3.2.0.

## Affected products

- Open Babel Open Babel 3.1.1, master commit 530dbfa3

## Timeline

- 2023-07-21: advisory: Initial advisory published by Talos and GitHub
- 2026-07-01: other: Advisory GHSA-v5fw-q4pf-8p2h withdrawn as a duplicate of GHSA-jg3h-pv7c-4f9c

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1666](https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1666)

## Related threats

- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46292-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in MSI parser translationVectors](https://junglewise.ai/threats/cve-2022-46295-open-babel-out-of-bounds-write-in-msi-parser-translationvectors)
- [Open Babel out-of-bounds write in MOPAC input parser](https://junglewise.ai/threats/cve-2022-46294-open-babel-out-of-bounds-write-in-mopac-input-parser)
- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46293-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in Gaussian translationVectors](https://junglewise.ai/threats/cve-2022-46291-open-babel-out-of-bounds-write-in-gaussian-translationvectors)