Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 21 July 2023.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open Babel out-of-bounds write in translationVectors parsing

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel, a widely used library for converting chemical data files, contains a security flaw in how it processes certain scientific file formats. By providing a specially crafted, malicious chemical data file to a system using this library, an attacker could potentially take control of the system or execute unauthorized commands. This is particularly concerning for web-based chemical converters or molecule viewers that use Open Babel to process user-uploaded files.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 21 July 2023.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network or with local access, in a software library.
Am I affected?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple out-of-bounds write vulnerabilities (CWE-787) exist in Open Babel 3.1.1 and master commit 530dbfa3 within the translationVectors parsing logic. The flaw is present in several format parsers including MSI, MOPAC, MOPAC Cartesian, and Gaussian. In these components, the code populates a fixed-size stack array of three vector3 objects without verifying the number of input tokens. An attacker can provide a malformed file with excessive translation vector entries, causing the 'numTranslationVectors' index to increment beyond the array bounds, leading to a stack-based buffer overflow. This can be exploited for arbitrary code execution. The vulnerability is addressed in version 3.2.0.

Affected products

Open Babel Open Babel 3.1.1, master commit 530dbfa3

Timeline

2023-07-21: advisory: Original Talos and GitHub advisories published.
2026-07-01: other: Advisory GHSA-jrjj-9h77-6vhv withdrawn as a duplicate of GHSA-mjmg-352j-f456.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.