CVE-2025-10995
published 2025-09-26CVE-2025-10995: A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.20%
10.2th percentile
A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in the library /src/zipstreamimpl.h. Such manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openbabel | — | — |
| debian | openbabel | >= 0 < 3.2.0 | 3.2.0 |
| openbabel | open_babel | <= 3.1.1 | — |
| openbabel | open_babel | — | — |
| openbabel | open_babel | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.04.3MEDIUMAV:L/AC:L/Au:S/C:P/I:P/A:P
osv4.8MEDIUM
vendor_debian4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-10995: openbabel - A security vulnerability has been detected in Open Babel up to 3.1.1. This vulne...
vendor_debian·2025·CVSS 4.8
CVE-2025-10995 [MEDIUM] CVE-2025-10995: openbabel - A security vulnerability has been detected in Open Babel up to 3.1.1. This vulne...
A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in the library /src/zipstreamimpl.h. Such manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow
ghsa·2026-06-30
CVE-2025-10995 [LOW] CWE-787 Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow
Open Babel has out-of-bounds write (overlapping memcpy) in zipstream basic_unzip_streambuf::underflow
### Summary
A memory-safety vulnerability in Open Babel's bundled zipstream
decompression code caused an out-of-bounds write via overlapping
`memcpy` when reading a crafted gzip-compressed chemistry file.
### Details
The flaw was in `basic_unzip_streambuf::underflow`. The decompression
buffer refill path invoked `memcpy` with overlapping source and
destination regions, which is undefined behavior and produced
out-of-bounds writes in practice. Any file format read through the
gzip-wrapped reader was a potential trigger.
### Impact
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may pa
OSV
CVE-2025-10995: A security vulnerability has been detected in Open Babel up to 3
osv·2025-09-26·CVSS 4.8
CVE-2025-10995 [MEDIUM] CVE-2025-10995: A security vulnerability has been detected in Open Babel up to 3
A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in the library /src/zipstreamimpl.h. Such manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.
GHSA
GHSA-5gfq-xrq4-34rj: A security vulnerability has been detected in Open Babel up to 3
ghsa_unreviewed·2025-09-26
CVE-2025-10995 [MEDIUM] CWE-119 GHSA-5gfq-xrq4-34rj: A security vulnerability has been detected in Open Babel up to 3
A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in the library /src/zipstreamimpl.h. Such manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.
No detection rules found.
No public exploits indexed.
2025-09-26
Published