Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
24 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the translationVectors[] array when reading the "UNIT CELL TRANSLATION" block of a crafted input file. Details The MOPAC output reader stored translation vectors from the UNIT CELL TRANSLATION block into a fixed-size translationVectors[] array. A malformed block could push more vectors than the array had slots, causing a write past the end of the array. One of five translationVectors[] OOB writes in the TALOS 2022 batch. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOPAC output file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's MSI parser allowed an out-of-bounds write into the translationVectors[] array when reading a crafted input file. Details The MSI reader stored cell translation vectors into a fixed-size translationVectors[] array. A malformed input could push more vectors than the array had slots, causing a write past the end of the array. One of five translationVectors[] OOB writes in the TALOS 2022 batch. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MSI file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit:…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's MOPAC input parser allowed an out-of-bounds write into the translationVectors[] array when reading Tv (translation-vector) atoms from a crafted input file. Details The MOPAC IN reader stored Tv-atom translation vectors into a fixed-size translationVectors[] array. A malformed input with more than three Tv atoms (or three plus extras) could push more vectors than the array had slots, causing a write past the end of the array. One of five translationVectors[] OOB writes in the TALOS 2022 batch. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOPAC input file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1.…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the translationVectors[] array when reading the "FINAL POINT" block of a crafted input file. Details The MOPAC output reader stored translation vectors from the FINAL POINT block into a fixed-size translationVectors[] array. A malformed block could push more vectors than the array had slots, causing a write past the end of the array. One of five translationVectors[] OOB writes in the TALOS 2022 batch. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOPAC output file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write into the translationVectors[] array when reading a crafted input file. Details The Gaussian reader stored periodic-cell translation vectors into a fixed-size translationVectors[] array. A malformed input could push more vectors than the array had slots, causing a write past the end of the array. This is one of five translationVectors[] OOB writes across formats (Gaussian, MOPAC, MOPAC IN, MSI) reported in the TALOS 2022 batch. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious Gaussian output file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Details A second variant of the nAtoms out-of-bounds write in the ORCA reader: a different malformed-input path produced the same class of write past the end of the destination buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious ORCA file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/b239d06e A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's ORCA parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the nAtoms handling of the ORCA reader. A malformed input caused the parser to write past the end of its destination buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious ORCA file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/b239d06e A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's PQS parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the pFormat handling of the PQS reader. A malformed input caused the parser to dereference a format pointer that had never been initialized. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious PQS file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/2a7d2cda A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under ASAN+UBSAN by…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's MSI parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the atom handling of the MSI reader. A malformed record caused the parser to dereference an atom pointer that had never been initialized. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MSI file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/fa9a2d9a A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under ASAN+UBSAN by…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's MOL2 parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the attribute/value parsing path of the MOL2 reader. An over-long attribute or value caused the parser to write past the end of a fixed-size destination buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOL2 file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/4110d59a A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's PQS parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordfile parsing path of the PQS reader. A malformed coord file specifier caused the parser to write past the end of its destination buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious PQS file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/2a7d2cda A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under ASAN+UBSAN by the…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the residue handling of the GRO reader. A malformed record caused the parser to use a residue pointer that had never been initialized. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious GRO file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/fa9a2d9a A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under ASAN+UBSAN by the…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's CSR parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the PadString helper used to handle the CSR title field. A title longer than the fixed destination buffer caused the parser to write past the end of the buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CSR file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/528c142f A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI build under…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordstype orientation parser inside the Gaussian output reader. A malformed orientation block caused the parser to write past the end of its destination buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious Gaussian output file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/528c142f A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's PQS parser caused an out-of-bounds (pre-buffer) read when reading a crafted input file. Details The flaw was in the lowerit helper used by the PQS parser. A malformed input caused the helper to read one or more bytes before the start of its input buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious PQS file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/f4a5ebae Fixes consolidated in #2913. A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's CACAO parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in CacaoFormat::SetHilderbrandt. A malformed input caused the parser to dereference a NULL pointer while applying the Hilderbrandt transformation. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CACAO file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/ecaed96f Originally reported as #2827; fixes consolidated in #2913. A minimized reproducer for this CVE is checked in under…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's ChemKin parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in ChemKinFormat::ReadReactionQualifierLines. A malformed reaction qualifier record caused the parser to dereference a NULL pointer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious ChemKin file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/af4a4212 Originally reported as #2829; fixes consolidated in #2913. A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's ChemKin parser caused a heap buffer overflow when reading a crafted input file. Details The flaw was in ChemKinFormat::CheckSpecies. A malformed species record caused the parser to write past the end of a heap-allocated buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious ChemKin file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/af4a4212 Originally reported as #2830; fixes consolidated in #2913. A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's SMILES parser caused a heap buffer overflow when reading a crafted input string. Details The flaw was in OBSmilesParser::ParseSmiles. A malformed SMILES input caused the parser to write past the end of a heap-allocated buffer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to parse a malicious SMILES string with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). SMILES strings are commonly passed on the command line and through scripted pipelines, so this primitive is especially reachable. Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/b34cd604 Originally reported as…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's bundled zipstream decompression code caused an out-of-bounds write via overlapping memcpy when reading a crafted gzip-compressed chemistry file. Details The flaw was in basicunzipstreambuf::underflow. The decompression buffer refill path invoked memcpy with overlapping source and destination regions, which is undefined behavior and produced out-of-bounds writes in practice. Any file format read through the gzip-wrapped reader was a potential trigger. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious gzip-compressed chemistry file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's GAMESS output parser caused a use-after-free when reading a crafted input file. Details The flaw was in GAMESSOutputFormat::ReadMolecule. A malformed input caused the parser to dereference a stale pointer after the underlying object had been freed. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious GAMESS output file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/95033d27 Originally reported as #2834; fixes consolidated in #2913. A minimized reproducer for this CVE is checked in under…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's CDXML file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::GetExplicitValence as called from the CDXML parser. A malformed fragment caused the parser to invoke the method on a NULL atom pointer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CDXML file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b Tracked in #2862. A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's MOL2 file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::SetFormalCharge as called from the MOL2 parser. A malformed atom record caused the parser to call the method on a NULL atom pointer. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOL2 file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b Tracked in #2862. A minimized reproducer for this CVE is checked in under test/files/fuzzregress/ and is exercised on every CI…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory-safety vulnerability in Open Babel's CIF file format parser allowed an out-of-bounds read when reading a crafted input file. Details The flaw was in OpenBabel::transform3d::DescribeAsString. A malformed symmetry-operation string caused the parser to read past the end of its internal buffer while formatting the description. Impact Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CIF file with the obabel tool, the OBConversion API, or any of the language bindings. Affected versions All releases up to and including 3.1.1. Patched version 3.2.0 (released 2026-05-26). Patch Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b Tracked in #2862. A minimized reproducer for this CVE is checked in at test/files/fuzzregress/cve-2026-2704.cif and…
Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.