Junglewise Threat Intelligence

Open Babel out-of-bounds write in zipstream underflow

Severity: medium · CVSS 5.3 · Published 2025-09-26

Technologies: openbabel (PyPI), Open Babel. Vendors: PyPI.

Executive brief

Open Babel, a chemical toolbox designed to speak many languages of chemical data, is vulnerable to memory corruption when processing certain compressed files. An attacker with local access to a system could use a specially crafted file to cause the application to crash or potentially execute unauthorized code. This could lead to a loss of system stability or unauthorized access to sensitive chemical research data.

Technical details

An out-of-bounds write vulnerability exists in Open Babel versions up to 3.1.1 within the `zlib_stream::basic_unzip_streambuf::underflow` function in `src/zipstreamimpl.h`. The issue stems from the use of `memcpy` on overlapping memory regions, which is undefined behavior and leads to memory corruption. An attacker can trigger this by providing a malformed input file that is processed by the library's zipstream implementation. While the attack requires local access to provide the malicious file, successful exploitation can result in a crash (DoS) or potentially arbitrary code execution. The vulnerability was identified via fuzzing and is addressed in version 3.2.0.

Affected products

  • Open Babel Open Babel <= 3.1.1

Timeline

  • 2025-09-14: disclosed: Issue reported on GitHub with PoC
  • 2025-09-26: advisory: Initial GHSA and NVD publication
  • 2026-06-30: patched: Version 3.2.0 released to address the issue

References

Related threats