Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 21 July 2023.

Is there a fix for This vulnerability?

A patch was published on 2026-07-01: Advisory withdrawn as duplicate of GHSA-mw5r-wq2m-397c; fix confirmed in 3.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network or with local access, in a software library.

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open Babel uninitialized pointer dereference in GRO residue parser

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel, a widely used library for converting chemical data files, contains a security flaw in how it processes certain molecular file formats. An attacker could provide a specially crafted, malicious file to a system using this library, potentially allowing them to take control of the system or execute unauthorized commands. This is particularly significant for web-based chemical converters or research tools that process user-uploaded files.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 21 July 2023.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0.
Is there a fix for This vulnerability?: A patch was published on 2026-07-01: Advisory withdrawn as duplicate of GHSA-mw5r-wq2m-397c; fix confirmed in 3.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network or with local access, in a software library.
Am I affected?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uninitialized pointer dereference vulnerability (CWE-824) exists in the GROFormat::ReadMolecule function within formats/groformat.cpp of Open Babel. The vulnerability occurs because the 'res' pointer is declared but not initialized. If a malformed GRO file provides a residue ID (resid) of 0 on the first atom line, the parser attempts to call AddAtom on the uninitialized 'res' pointer instead of creating a new residue object. An attacker can exploit this by providing a malicious file to the obabel converter or any application using the library, potentially achieving arbitrary code execution. The issue is fixed in version 3.2.0.

Affected products

Open Babel Open Babel 3.1.1, master commit 530dbfa3, and all versions prior to 3.2.0

Timeline

2022-10-25: disclosed: Initial discovery by Talos (TALOS-2022-1668)
2023-07-21: advisory: Original advisory published
2026-07-01: patched: Advisory withdrawn as duplicate of GHSA-mw5r-wq2m-397c; fix confirmed in 3.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.