Executive brief
Open Babel, a widely used library for converting chemical data formats, contains a critical security flaw in how it handles certain file types. An attacker could provide a specially crafted file to a system using this library—such as an online molecule viewer or chemical converter—to take control of the application. This could lead to unauthorized access to data or the ability to run malicious code on the server.
Technical details
A use of uninitialized pointer vulnerability (CWE-824) exists in the Parallel Quantum Solutions (PQS) format parser within Open Babel's `ReadMolecule` function in `formats/PQSformat.cpp`. The vulnerability occurs when the parser encounters a 'geom' line containing a 'file=' reference but fails to match any of the expected format identifiers (e.g., =car, =hin, =pdb, =mop). In this scenario, the `pFormat` pointer remains uninitialized before being used to call a virtual function. Because the pointer is stored on the stack, an attacker can potentially control the execution flow by providing a malformed input file, leading to arbitrary code execution. The issue is reachable remotely if the library is used in network-facing applications like web-based chemical converters.
Affected products
- Open Babel Open Babel 3.1.1, master commit 530dbfa3, all versions before 3.2.0
Timeline
- 2023-07-21: advisory: Initial advisory published by Talos and GitHub
- 2026-07-01: other: Advisory withdrawn as a duplicate of GHSA-8qxc-57hf-hc9j