Executive brief
Open Babel, a widely used library for converting chemical data files, contains a security flaw in how it processes certain molecular file formats. An attacker could provide a specially crafted, malicious file to a system using this library, potentially allowing them to take control of the system or execute unauthorized commands. This is particularly significant for web-based chemical converters or research tools that process user-uploaded files.
Technical details
An uninitialized pointer dereference vulnerability (CWE-824) exists in the GROFormat::ReadMolecule function within formats/groformat.cpp of Open Babel. The vulnerability occurs because the 'res' pointer is declared but not initialized. If a malformed GRO file provides a residue ID (resid) of 0 on the first atom line, the parser attempts to call AddAtom on the uninitialized 'res' pointer instead of creating a new residue object. An attacker can exploit this by providing a malicious file to the obabel converter or any application using the library, potentially achieving arbitrary code execution. The issue is fixed in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3, and all versions prior to 3.2.0
Timeline
- 2022-10-25: disclosed: Initial discovery by Talos (TALOS-2022-1668)
- 2023-07-21: advisory: Original advisory published
- 2026-07-01: patched: Advisory withdrawn as duplicate of GHSA-mw5r-wq2m-397c; fix confirmed in 3.2.0