GHSA-rxpr-wq63-jr7p CVE-2026-3408 PYSEC-2026-2791
Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.56%
- Chance of exploitation in the next 30 days. Higher than 46.50% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-476 NULL Pointer Dereference
- Fix
3.2.0- Upgrade openbabel to this version or later
Description
Summary
A memory-safety vulnerability in Open Babel's CDXML file format parser caused a NULL pointer dereference when reading a crafted input file.
Details
The flaw was in OBAtom::GetExplicitValence as called from the CDXML
parser. A malformed fragment caused the parser to invoke the method
on a NULL atom pointer.
Impact
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious CDXML file with the obabel
tool, the OBConversion API, or any of the language bindings (Python,
Ruby, Java, R, Perl, C#, PHP).
Affected versions
All releases up to and including 3.1.1.
Patched version
3.2.0 (released 2026-05-26).
Patch
Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b Tracked in #2862.
A minimized reproducer for this CVE is checked in under
test/files/fuzz_regress/ and is exercised on every CI build under
ASAN+UBSAN by the fuzzregresstest harness.
Credit
Reported by Vedant Madane (@VedantMadane) via VulDB.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| openbabel | < 3.2.0 |
3.2.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
openbabel PyPI → 3.2.0
- pip
pip install --upgrade "openbabel>=3.2.0"- poetry
poetry add "openbabel>=3.2.0"- uv
uv add "openbabel>=3.2.0"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Proof of concept
CVSS 3.1 5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Requirements: Select a programming language that is not susceptible to these issues.
- Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
- Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
References
Advisories
Packages
Other links
- github.com/openbabel/openbabel/security/advisories/GHSA-rxpr-wq63-jr7p
- github.com/openbabel/openbabel/issues/2848
- github.com/openbabel/openbabel/pull/2862
- github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a
- github.com/oneafter/0128/blob/main/ob3/repro.cdxml
- vuldb.com
- vuldb.com
- vuldb.com
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-55f6-pf8r-c2f4 Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION) | High | Also affects openbabel |
| GHSA-f8h2-c479-vqxf Open Babel has out-of-bounds write in MSI translationVectors[] | High | Also affects openbabel |
| GHSA-mjmg-352j-f456 Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom) | High | Also affects openbabel |
| GHSA-7h6r-6p76-68c9 Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT) | High | Also affects openbabel |
| GHSA-jg3h-pv7c-4f9c Open Babel has out-of-bounds write in Gaussian translationVectors[] | High | Also affects openbabel |
| GHSA-5rff-8f7c-8jmw Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant) | High | Also affects openbabel |
| GHSA-rj4c-r689-cm87 Open Babel has out-of-bounds write in ORCA nAtoms parser | High | Also affects openbabel |
| GHSA-8qxc-57hf-hc9j Open Babel has uninitialized pointer dereference in PQS pFormat | High | Also affects openbabel |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor