# Open Babel uninitialized pointer dereference in GRO residue parser

Source: https://junglewise.ai/threats/open-babel-uninitialized-pointer-dereference-in-gro-residue-parser-c86e74aa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-21. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel, a widely used library for converting chemical data files, contains a security flaw in how it processes certain molecular file formats. An attacker could provide a specially crafted, malicious file to a system using this library, potentially allowing them to take control of the system or execute unauthorized commands. This is particularly significant for web-based chemical converters or research tools that process user-uploaded files.

Technologies: [openbabel (PyPI)](https://junglewise.ai/threats/technologies/openbabel). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.8, published 21 July 2023.

**Which products and versions are affected?** openbabel (PyPI) < 3.2.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-01: Advisory withdrawn as duplicate of GHSA-mw5r-wq2m-397c; fix confirmed in 3.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected?** Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uninitialized pointer dereference vulnerability (CWE-824) exists in the GROFormat::ReadMolecule function within formats/groformat.cpp of Open Babel. The vulnerability occurs because the 'res' pointer is declared but not initialized. If a malformed GRO file provides a residue ID (resid) of 0 on the first atom line, the parser attempts to call AddAtom on the uninitialized 'res' pointer instead of creating a new residue object. An attacker can exploit this by providing a malicious file to the obabel converter or any application using the library, potentially achieving arbitrary code execution. The issue is fixed in version 3.2.0.

## Affected products

- Open Babel Open Babel 3.1.1, master commit 530dbfa3, and all versions prior to 3.2.0

## Timeline

- 2022-10-25: disclosed: Initial discovery by Talos (TALOS-2022-1668)
- 2023-07-21: advisory: Original advisory published
- 2026-07-01: patched: Advisory withdrawn as duplicate of GHSA-mw5r-wq2m-397c; fix confirmed in 3.2.0

## References

- [https://talosintelligence.com/vulnerability_reports/TALOS-2022-1668](https://talosintelligence.com/vulnerability_reports/TALOS-2022-1668)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1668](https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1668)

## Related threats

- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46292-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in MSI parser translationVectors](https://junglewise.ai/threats/cve-2022-46295-open-babel-out-of-bounds-write-in-msi-parser-translationvectors)
- [Open Babel out-of-bounds write in MOPAC input parser](https://junglewise.ai/threats/cve-2022-46294-open-babel-out-of-bounds-write-in-mopac-input-parser)
- [Open Babel out-of-bounds write in MOPAC output parser](https://junglewise.ai/threats/cve-2022-46293-open-babel-out-of-bounds-write-in-mopac-output-parser)
- [Open Babel out-of-bounds write in Gaussian translationVectors](https://junglewise.ai/threats/cve-2022-46291-open-babel-out-of-bounds-write-in-gaussian-translationvectors)