Executive brief
Open Babel is a widely used software library for converting and viewing chemical data files. A security flaw in how it handles certain file formats allows an attacker to execute malicious code by providing a specially crafted file. This could lead to a complete system takeover, data theft, or service disruption, especially for web-based chemical converters or research tools that use this library.
Technical details
An uninitialized pointer vulnerability (CWE-824) exists in the MSIFormat::ReadMolecule function within formats/msiformat.cpp of Open Babel. The parser declares an OBAtom pointer on the stack but fails to initialize it if certain expected tags (like 'ACL') are missing or if 'XYZ' tags are processed prematurely. An attacker can provide a malformed MSI file that triggers a call to SetVector using this uninitialized pointer, providing a powerful primitive for arbitrary memory writes. While the attack is local in nature (file parsing), the CVSS reflects a network vector because Open Babel is frequently used in network-accessible backend services for chemical format conversion. The issue is resolved in version 3.2.0.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3, and all versions prior to 3.2.0
Timeline
- 2023-07-21: disclosed: Original advisory published by Talos and GitHub
- 2023-07-21: advisory: NVD publication of CVE-2022-44451
- 2026-07-01: other: Advisory GHSA-x3cp-4x6w-vm7p withdrawn as a duplicate of GHSA-jr2x-6qf6-q5mc