Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 21 July 2023.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open Babel uninitialized pointer dereference in PQS format parser

Severity: critical · CVSS 9.8 · Published 2023-07-21

Open Babel, a widely used library for converting chemical data formats, contains a critical security flaw in how it handles certain file types. An attacker could provide a specially crafted file to a system using this library—such as an online molecule viewer or chemical converter—to take control of the application. This could lead to unauthorized access to data or the ability to run malicious code on the server.

Technologies: openbabel (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 21 July 2023.
Which products and versions are affected?: openbabel (PyPI) < 3.2.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run openbabel (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use of uninitialized pointer vulnerability (CWE-824) exists in the Parallel Quantum Solutions (PQS) format parser within Open Babel's `ReadMolecule` function in `formats/PQSformat.cpp`. The vulnerability occurs when the parser encounters a 'geom' line containing a 'file=' reference but fails to match any of the expected format identifiers (e.g., =car, =hin, =pdb, =mop). In this scenario, the `pFormat` pointer remains uninitialized before being used to call a virtual function. Because the pointer is stored on the stack, an attacker can potentially control the execution flow by providing a malformed input file, leading to arbitrary code execution. The issue is reachable remotely if the library is used in network-facing applications like web-based chemical converters.

Affected products

Open Babel Open Babel 3.1.1, master commit 530dbfa3, all versions before 3.2.0

Timeline

2023-07-21: advisory: Initial advisory published by Talos and GitHub
2026-07-01: other: Advisory withdrawn as a duplicate of GHSA-8qxc-57hf-hc9j

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.