# Open Babel out-of-bounds write in zipstream underflow

Source: https://junglewise.ai/threats/open-babel-out-of-bounds-write-in-zipstream-underflow-cd0c03f6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-26. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.3 · Published 2025-09-26

Open Babel, a chemical toolbox designed to speak many languages of chemical data, is vulnerable to memory corruption when processing certain compressed files. An attacker with local access to a system could use a specially crafted file to cause the application to crash or potentially execute unauthorized code. This could lead to a loss of system stability or unauthorized access to sensitive chemical research data.

Technologies: [openbabel (PyPI)](https://junglewise.ai/threats/technologies/openbabel). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.3, published 26 September 2025.

**Which products and versions are affected?** openbabel (PyPI) < 3.2.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-30: Version 3.2.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in Open Babel versions up to 3.1.1 within the `zlib_stream::basic_unzip_streambuf::underflow` function in `src/zipstreamimpl.h`. The issue stems from the use of `memcpy` on overlapping memory regions, which is undefined behavior and leads to memory corruption. An attacker can trigger this by providing a malformed input file that is processed by the library's zipstream implementation. While the attack requires local access to provide the malicious file, successful exploitation can result in a crash (DoS) or potentially arbitrary code execution. The vulnerability was identified via fuzzing and is addressed in version 3.2.0.

## Affected products

- Open Babel Open Babel <= 3.1.1

## Timeline

- 2025-09-14: disclosed: Issue reported on GitHub with PoC
- 2025-09-26: advisory: Initial GHSA and NVD publication
- 2026-06-30: patched: Version 3.2.0 released to address the issue

## References

- [https://github.com/openbabel/openbabel/issues/2832](https://github.com/openbabel/openbabel/issues/2832)
- [https://github.com/user-attachments/files/22318572/poc.zip](https://github.com/user-attachments/files/22318572/poc.zip)
- [https://vuldb.com/?ctiid.325923](https://vuldb.com/?ctiid.325923)
- [https://vuldb.com/?id.325923](https://vuldb.com/?id.325923)
- [https://vuldb.com/?submit.654059](https://vuldb.com/?submit.654059)

## Related threats

- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46292-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in MSI parser translationVectors](https://junglewise.ai/threats/cve-2022-46295-open-babel-out-of-bounds-write-in-msi-parser-translationvectors)
- [Open Babel out-of-bounds write in MOPAC input parser](https://junglewise.ai/threats/cve-2022-46294-open-babel-out-of-bounds-write-in-mopac-input-parser)
- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46293-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in Gaussian translationVectors](https://junglewise.ai/threats/cve-2022-46291-open-babel-out-of-bounds-write-in-gaussian-translationvectors)