CVE-2026-2704
published 2026-02-19CVE-2026-2704: A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file…
PriorityP346high8.1CVSS 3.1
AVNACLPRNUIRSUCHINAH
EPSS
0.76%
51.4th percentile
A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is sufficient to fix this issue. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openbabel | — | — |
| debian | openbabel | >= 0 < 3.2.0 | 3.2.0 |
| openbabel | open_babel | <= 3.1.1 | — |
| openbabel | open_babel | — | — |
| openbabel | open_babel | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString
ghsa·2026-06-30
CVE-2026-2704 [LOW] CWE-119 Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString
Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString
> ### Summary
>
> A memory-safety vulnerability in Open Babel's CIF file format parser
> allowed an out-of-bounds read when reading a crafted input file.
>
> ### Details
>
> The flaw was in `OpenBabel::transform3d::DescribeAsString`. A malformed
> symmetry-operation string caused the parser to read past the end of its
> internal buffer while formatting the description.
>
> ### Impact
>
> Open Babel is a C++ library and CLI used to read and write chemistry
> file formats; it is shipped by Linux distributions and embedded in
> services that may parse untrusted input. Triggering this vulnerability
> requires the victim to open a malicious CIF file with the `obabel`
> tool, the OBConversion API, or any of the language b
VulDB
Open Babel up to 3.1.1 CIF File src/math/transform3d.cpp DescribeAsString out-of-bounds (Issue 2848 / Nessus ID 299600)
vuldb·2026-06-01·CVSS 2.1
CVE-2026-2704 [LOW] Open Babel up to 3.1.1 CIF File src/math/transform3d.cpp DescribeAsString out-of-bounds (Issue 2848 / Nessus ID 299600)
A vulnerability identified as critical has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read.
This vulnerability is traded as CVE-2026-2704. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
It is suggested to install a patch to address this issue.
OSV
CVE-2026-2704: A security vulnerability has been detected in Open Babel up to 3
osv·2026-02-19·CVSS 5.3
CVE-2026-2704 [MEDIUM] CVE-2026-2704: A security vulnerability has been detected in Open Babel up to 3
A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue. The project was informed of the problem early through an issue report but has not responded yet.
GHSA
GHSA-2m54-8m6g-qf93: A security vulnerability has been detected in Open Babel up to 3
ghsa_unreviewed·2026-02-19
CVE-2026-2704 [MEDIUM] CWE-119 GHSA-2m54-8m6g-qf93: A security vulnerability has been detected in Open Babel up to 3
A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Debian
CVE-2026-2704: openbabel - A security vulnerability has been detected in Open Babel up to 3.1.1. The affect...
vendor_debian·2026·CVSS 5.3
CVE-2026-2704 [MEDIUM] CVE-2026-2704: openbabel - A security vulnerability has been detected in Open Babel up to 3.1.1. The affect...
A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue. The project was informed of the problem early through an issue report but has not responded yet.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08ahttps://github.com/oneafter/0128/blob/main/ob1/repro.cifhttps://github.com/openbabel/openbabel/issues/2848https://github.com/openbabel/openbabel/pull/2862https://github.com/openbabel/openbabel/releases/tag/openbabel-3-2-0https://github.com/openbabel/openbabel/security/advisories/GHSA-6xw4-2g22-26h8https://vuldb.com/submit/754378https://vuldb.com/vuln/346650https://vuldb.com/vuln/346650/cti
2026-02-19
Published