CVE-2025-11000
published 2025-09-26CVE-2025-11000: A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
8.6th percentile
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openbabel | — | — |
| debian | openbabel | >= 0 < 3.2.0 | 3.2.0 |
| openbabel | open_babel | <= 3.1.1 | — |
| openbabel | open_babel | — | — |
| openbabel | open_babel | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
osv4.8MEDIUM
vendor_debian4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-11000: openbabel - A vulnerability was determined in Open Babel up to 3.1.1. This affects the funct...
vendor_debian·2025·CVSS 4.8
CVE-2025-11000 [MEDIUM] CVE-2025-11000: openbabel - A vulnerability was determined in Open Babel up to 3.1.1. This affects the funct...
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)
ghsa·2026-07-01
CVE-2025-11000 [MEDIUM] CWE-125 Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)
Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)
### Summary
A memory-safety vulnerability in Open Babel's PQS parser caused an
out-of-bounds (pre-buffer) read when reading a crafted input file.
### Details
The flaw was in the `lowerit` helper used by the PQS parser. A
malformed input caused the helper to read one or more bytes before
the start of its input buffer.
### Impact
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious PQS file with the `obabel`
tool, the `OBConversion` API, or any of the language bindings (Python,
Ruby, Java, R, Perl, C#, PHP).
### Affected version
GHSA
GHSA-7x26-54jj-cvhr: A vulnerability was determined in Open Babel up to 3
ghsa_unreviewed·2025-09-26
CVE-2025-11000 [MEDIUM] CWE-404 GHSA-7x26-54jj-cvhr: A vulnerability was determined in Open Babel up to 3
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
OSV
CVE-2025-11000: A vulnerability was determined in Open Babel up to 3
osv·2025-09-26·CVSS 4.8
CVE-2025-11000 [MEDIUM] CVE-2025-11000: A vulnerability was determined in Open Babel up to 3
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
No detection rules found.
No public exploits indexed.
2025-09-26
Published