CVE-2026-3408
published 2026-03-02CVE-2026-3408: A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.39%
31.6th percentile
A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openbabel | — | — |
| debian | openbabel | >= 0 < 3.2.0 | 3.2.0 |
| openbabel | open_babel | <= 3.1.1 | — |
| openbabel | open_babel | — | — |
| openbabel | open_babel | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2026-3408: openbabel - A vulnerability was identified in Open Babel up to 3.1.1. This impacts the funct...
vendor_debian·2026·CVSS 5.3
CVE-2026-3408 [MEDIUM] CVE-2026-3408: openbabel - A vulnerability was identified in Open Babel up to 3.1.1. This impacts the funct...
A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
GHSA
Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence
ghsa·2026-06-30
CVE-2026-3408 [LOW] CWE-476 Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence
Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence
### Summary
A memory-safety vulnerability in Open Babel's CDXML file format parser
caused a NULL pointer dereference when reading a crafted input file.
### Details
The flaw was in `OBAtom::GetExplicitValence` as called from the CDXML
parser. A malformed fragment caused the parser to invoke the method
on a NULL atom pointer.
### Impact
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious CDXML file with the `obabel`
tool, the `OBConversion` API, or any of the language bindings (Python,
Ruby, Java, R, Perl, C#, PHP).
OSV
CVE-2026-3408: A vulnerability was identified in Open Babel up to 3
osv·2026-03-02·CVSS 5.3
CVE-2026-3408 [MEDIUM] CVE-2026-3408: A vulnerability was identified in Open Babel up to 3
A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.
GHSA
GHSA-fg6r-xgp8-x64r: A vulnerability was identified in Open Babel up to 3
ghsa_unreviewed·2026-03-02
CVE-2026-3408 [MEDIUM] CWE-404 GHSA-fg6r-xgp8-x64r: A vulnerability was identified in Open Babel up to 3
A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.
No detection rules found.
No public exploits indexed.
https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08ahttps://github.com/oneafter/0128/blob/main/ob3/repro.cdxmlhttps://github.com/openbabel/openbabel/issues/2848https://github.com/openbabel/openbabel/pull/2862https://vuldb.com/?ctiid.348303https://vuldb.com/?id.348303https://vuldb.com/?submit.763756
2026-03-02
Published