{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/chemistry/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openbabel:open_babel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2025-10996"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open Babel (\u003c 3.2.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","buffer-overflow","chemistry","library","cve"],"_cs_type":"advisory","_cs_vendors":["Open Babel"],"content_html":"\u003cp\u003eA critical memory-safety vulnerability, tracked as CVE-2025-10996, has been identified in Open Babel, a widely used C++ chemistry library and command-line tool. The flaw specifically resides within the \u003ccode\u003eOBSmilesParser::ParseSmiles\u003c/code\u003e function, which is responsible for interpreting SMILES (Simplified Molecular Input Line Entry Specification) strings. When processing a specially crafted and malformed SMILES input, the parser can write beyond the boundaries of a heap-allocated buffer, leading to a heap buffer overflow. This vulnerability affects all Open Babel versions up to and including 3.1.1. It is particularly concerning because Open Babel is often embedded in services that parse untrusted input and SMILES strings are frequently handled via command-line arguments and automated script pipelines, making the exploitation primitive easily reachable. A patch was released in version 3.2.0 on May 26, 2026, addressing the issue.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eAttacker crafts malicious SMILES string\u003c/strong\u003e: The attacker develops a specially engineered SMILES string designed to exploit the heap buffer overflow vulnerability in Open Babel's \u003ccode\u003eOBSmilesParser::ParseSmiles\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAttacker delivers malicious SMILES string\u003c/strong\u003e: The crafted SMILES string is delivered to the victim, potentially via a malicious file (e.g., a \u003ccode\u003e.smi\u003c/code\u003e file), an email attachment, or as input within a web application or scientific workflow.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVictim initiates SMILES parsing\u003c/strong\u003e: The victim, or an automated system, processes the malicious SMILES string using Open Babel through the \u003ccode\u003eobabel\u003c/code\u003e command-line tool, the \u003ccode\u003eOBConversion\u003c/code\u003e API, or any of its language bindings (Python, Ruby, Java, R, Perl, C#, PHP).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eOBSmilesParser::ParseSmiles\u003c/code\u003e is invoked\u003c/strong\u003e: Open Babel's internal \u003ccode\u003eOBSmilesParser::ParseSmiles\u003c/code\u003e function is called to interpret the malformed SMILES input string.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHeap buffer overflow triggers\u003c/strong\u003e: During parsing, the specially crafted SMILES string causes the \u003ccode\u003eParseSmiles\u003c/code\u003e function to write data beyond the allocated memory region on the heap.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMemory corruption and impact\u003c/strong\u003e: This heap buffer overflow leads to memory corruption, which can result in a denial-of-service (DoS) condition by crashing the application, or, if successfully manipulated, arbitrary code execution within the context of the vulnerable Open Babel process.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePost-exploitation (if RCE achieved)\u003c/strong\u003e: If arbitrary code execution is achieved, the attacker gains control over the compromised process, potentially enabling further actions such as data exfiltration, system compromise, or malware deployment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe exploitation of CVE-2025-10996 can lead to severe consequences for organizations utilizing Open Babel. At minimum, a successful attack will result in a denial-of-service (DoS) condition, causing the Open Babel application or any service embedding it to crash. More critically, skilled attackers could potentially leverage this heap buffer overflow to achieve arbitrary code execution, granting them unauthorized control over the affected system. Organizations in scientific research, chemical industries, and any sector relying on chemical data processing and Open Babel for parsing untrusted SMILES input are at risk. The broad deployment of Open Babel, including its presence in Linux distributions and various language bindings, expands the potential attack surface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2025-10996 immediately by upgrading Open Babel to version 3.2.0 or later on all affected systems and integrated services.\u003c/li\u003e\n\u003cli\u003eReview all instances where Open Babel is used to parse external or untrusted SMILES input, especially those invoked via command-line or programmatic APIs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-03T13:02:04Z","date_published":"2026-07-03T13:02:04Z","id":"https://feed.craftedsignal.io/briefs/2026-07-open-babel-heap-buffer-overflow/","summary":"A heap buffer overflow vulnerability (CVE-2025-10996) in Open Babel's `OBSmilesParser::ParseSmiles` function allows attackers to achieve denial of service or arbitrary code execution by crafting and supplying a malformed SMILES input string to affected versions up to 3.1.1.","title":"Open Babel Heap Buffer Overflow in SMILES Parsing (CVE-2025-10996)","url":"https://feed.craftedsignal.io/briefs/2026-07-open-babel-heap-buffer-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openbabel:open_babel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2025-10997"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open Babel (\u003c 3.2.0)","pip/openbabel (\u003c 3.2.0)"],"_cs_severities":["high"],"_cs_tags":["chemistry","vulnerability","buffer-overflow","memory-corruption","cve"],"_cs_type":"advisory","_cs_vendors":["Open Babel"],"content_html":"\u003cp\u003eA memory-safety vulnerability, identified as CVE-2025-10997, has been discovered in Open Babel, a widely used C++ library and command-line tool for chemistry file format conversion. This flaw, reported via OSS-Fuzz, specifically exists within the \u003ccode\u003eChemKinFormat::CheckSpecies\u003c/code\u003e function of the ChemKin parser. Attackers can exploit this vulnerability by crafting a malicious ChemKin file that, when processed by a victim using Open Babel components (such as the \u003ccode\u003eobabel\u003c/code\u003e tool, the \u003ccode\u003eOBConversion\u003c/code\u003e API, or its language bindings), causes a heap buffer overflow. This leads to memory corruption, potentially resulting in application crashes (Denial of Service) or, under certain conditions, arbitrary code execution. All Open Babel releases up to and including version 3.1.1 are affected; the vulnerability was patched in version 3.2.0, released on 2026-05-26.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious ChemKin file specifically designed to contain malformed species records, triggering the heap buffer overflow in \u003ccode\u003eChemKinFormat::CheckSpecies\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe malicious ChemKin file is delivered to the victim, typically via social engineering (e.g., email attachment), malicious download link, or embedding within a seemingly legitimate data set.\u003c/li\u003e\n\u003cli\u003eThe victim interacts with the malicious file, causing it to be processed by an Open Babel component, such as the \u003ccode\u003eobabel\u003c/code\u003e command-line tool, the \u003ccode\u003eOBConversion\u003c/code\u003e API, or one of its language bindings (Python, Ruby, Java, etc.).\u003c/li\u003e\n\u003cli\u003eOpen Babel's internal parser, specifically within the \u003ccode\u003eChemKinFormat::CheckSpecies\u003c/code\u003e function, attempts to process the malformed species record from the crafted file.\u003c/li\u003e\n\u003cli\u003eDue to the malformed data, the \u003ccode\u003eChemKinFormat::CheckSpecies\u003c/code\u003e function attempts to write data beyond the allocated bounds of a heap-allocated buffer.\u003c/li\u003e\n\u003cli\u003eThis heap buffer overflow corrupts memory, leading to an application crash (Denial of Service) or, under specific conditions, allows for arbitrary code execution on the victim's system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2025-10997 can lead to severe consequences for systems processing untrusted ChemKin files with affected versions of Open Babel. The primary impact includes denial of service, as the application processing the malicious file will likely crash due to memory corruption. More critically, sophisticated exploitation could lead to arbitrary code execution, granting attackers control over the compromised system. Open Babel is widely integrated, being shipped by Linux distributions and embedded in various services that parse chemical file formats. Organizations using Open Babel in such contexts, especially those handling external or untrusted data, are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2025-10997 by upgrading all instances of Open Babel and its language bindings to version 3.2.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all ChemKin files processed by applications utilizing Open Babel components to mitigate risks from specially crafted inputs.\u003c/li\u003e\n\u003cli\u003eMonitor systems that utilize Open Babel for unexpected application crashes or unusual process behavior that could indicate attempted exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-03T13:01:12Z","date_published":"2026-07-03T13:01:12Z","id":"https://feed.craftedsignal.io/briefs/2026-07-open-babel-heap-overflow/","summary":"A heap buffer overflow vulnerability (CVE-2025-10997) in Open Babel's ChemKin parser allows an attacker to achieve memory corruption when a victim processes a specially crafted ChemKin file, potentially leading to denial of service or arbitrary code execution.","title":"Open Babel Heap Buffer Overflow in ChemKin Parser (CVE-2025-10997)","url":"https://feed.craftedsignal.io/briefs/2026-07-open-babel-heap-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openbabel:open_babel:3.1.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2022-43607"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open Babel (up to 3.1.1)","openbabel (pip) (up to 3.1.1)"],"_cs_severities":["high"],"_cs_tags":["memory-safety","vulnerability","library","cve","file-parsing","chemistry","denial-of-service","code-execution"],"_cs_type":"threat","_cs_vendors":["Open Babel"],"content_html":"\u003cp\u003eCisco TALOS reported a critical memory-safety vulnerability, CVE-2022-43607, affecting Open Babel versions up to 3.1.1. This flaw resides within the MOL2 file format parser, specifically in the attribute/value parsing path. An attacker can craft a malicious MOL2 file containing an overly long attribute or value, which, when processed by the vulnerable Open Babel software, triggers an out-of-bounds write. This vulnerability is significant because Open Babel is a widely used C++ library and command-line interface (\u003ccode\u003eobabel\u003c/code\u003e) for manipulating chemistry file formats, often embedded in scientific applications and services. The vulnerability can be exploited when a victim opens a specially crafted MOL2 file using the \u003ccode\u003eobabel\u003c/code\u003e tool, the \u003ccode\u003eOBConversion\u003c/code\u003e API, or any of its language bindings (Python, Ruby, Java, R, Perl, C#, PHP). This can lead to memory corruption, denial of service, or potentially arbitrary code execution if successfully weaponized.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious MOL2 file containing an over-long attribute or value designed to exceed a fixed-size buffer.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers this crafted MOL2 file to a target system or user (e.g., via email, web download, or shared storage).\u003c/li\u003e\n\u003cli\u003eThe victim opens or processes the malicious MOL2 file using the \u003ccode\u003eobabel\u003c/code\u003e command-line tool, the \u003ccode\u003eOBConversion\u003c/code\u003e API, or one of Open Babel's language bindings.\u003c/li\u003e\n\u003cli\u003eOpen Babel's MOL2 parser attempts to parse the malicious file's attributes and values.\u003c/li\u003e\n\u003cli\u003eDuring parsing, the overly long data triggers an out-of-bounds write operation past the end of an allocated memory buffer.\u003c/li\u003e\n\u003cli\u003eThis memory corruption can lead to a crash of the Open Babel process, resulting in a denial of service (DoS).\u003c/li\u003e\n\u003cli\u003eWith sophisticated exploitation, this memory corruption could potentially be leveraged to achieve arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2022-43607 can result in memory corruption, leading to a denial of service (DoS) by crashing the application or tool processing the malicious MOL2 file. In more severe scenarios, it could enable arbitrary code execution, granting attackers control over the compromised system. While no specific in-the-wild exploitation has been observed, the widespread use of Open Babel in academic, research, and industrial sectors that handle chemical data means that a broad range of organizations could be affected. Any service or workstation that uses Open Babel to parse untrusted MOL2 files is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2022-43607 by updating Open Babel to version 3.2.0 or later immediately across all affected systems.\u003c/li\u003e\n\u003cli\u003eImplement process creation logging (e.g., Sysmon for Windows or Auditd for Linux) to activate the provided Sigma rule for \u003ccode\u003eobabel\u003c/code\u003e execution.\u003c/li\u003e\n\u003cli\u003eReview and tune the provided Sigma rule to monitor for unusual invocations of the \u003ccode\u003eobabel\u003c/code\u003e command-line tool, especially from untrusted sources or with uncommon parameters.\u003c/li\u003e\n\u003cli\u003eEducate users on the risks of opening untrusted or suspicious MOL2 files received from unknown sources, as user interaction is required for exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-03T12:52:17Z","date_published":"2026-07-03T12:52:17Z","id":"https://feed.craftedsignal.io/briefs/2026-07-openbabel-oob-write/","summary":"A memory-safety vulnerability, CVE-2022-43607, in Open Babel's MOL2 parser allows an out-of-bounds write when processing a crafted input file, potentially leading to denial of service or arbitrary code execution.","title":"Open Babel MOL2 Parser Out-of-Bounds Write (CVE-2022-43607)","url":"https://feed.craftedsignal.io/briefs/2026-07-openbabel-oob-write/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openbabel:open_babel:3.1.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2022-44451"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open Babel (\u003c 3.2.0)"],"_cs_severities":["high"],"_cs_tags":["chemistry","vulnerability","memory-safety","open-babel","cve"],"_cs_type":"advisory","_cs_vendors":["Open Babel"],"content_html":"\u003cp\u003eA memory-safety vulnerability, identified as CVE-2022-44451, has been discovered in Open Babel, a widely used C++ library and command-line interface for chemistry file format manipulation. Reported by Cisco TALOS, this flaw exists within Open Babel's MSI atom parser, leading to an uninitialized pointer dereference when processing a specially crafted input file. This vulnerability affects all Open Babel versions up to and including 3.1.1. Attackers could exploit this by convincing a victim to open a malicious MSI file using the \u003ccode\u003eobabel\u003c/code\u003e CLI tool, the \u003ccode\u003eOBConversion\u003c/code\u003e API, or any of its language bindings (Python, Ruby, Java, R, Perl, C#, PHP). This could lead to application instability, crashes, or denial of service on systems that parse untrusted chemical file formats, impacting scientific computing environments and services embedding the library.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious MSI (Molecular Structure Input) file specifically designed to trigger the uninitialized pointer dereference vulnerability (CVE-2022-44451) within Open Babel's parser.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers this malicious MSI file to a target system or user, potentially through phishing emails, malicious websites, or embedding it within a seemingly legitimate data set.\u003c/li\u003e\n\u003cli\u003eThe victim opens or attempts to process the malicious MSI file using the \u003ccode\u003eobabel\u003c/code\u003e command-line tool, an application leveraging the \u003ccode\u003eOBConversion\u003c/code\u003e API, or any of Open Babel's language bindings (e.g., Python, Ruby).\u003c/li\u003e\n\u003cli\u003eOpen Babel's internal MSI parser begins to process the malformed record within the crafted input file.\u003c/li\u003e\n\u003cli\u003eDuring atom handling, the parser attempts to dereference an atom pointer that has not been properly initialized, triggering the memory-safety flaw.\u003c/li\u003e\n\u003cli\u003eThis uninitialized pointer dereference causes the Open Babel application or the service embedding it to crash or become unstable.\u003c/li\u003e\n\u003cli\u003eThe final objective is application denial of service or potential arbitrary code execution, impacting the availability and integrity of the affected system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability primarily results in application instability or denial of service, as the affected Open Babel process crashes when attempting to parse a malicious MSI file. Given Open Babel's role as a core library and CLI tool shipped by various Linux distributions and embedded in services that process chemical file formats, a successful attack could disrupt scientific computing workflows, research data processing, or any service relying on Open Babel for untrusted input parsing. While no specific victim counts are available, the broad usage of Open Babel implies a significant potential attack surface across academic, research, and industrial sectors utilizing computational chemistry.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Open Babel installations to version 3.2.0 or newer to mitigate CVE-2022-44451, as indicated by the \u003ccode\u003ePatched version\u003c/code\u003e details.\u003c/li\u003e\n\u003cli\u003eImplement robust input validation and sanitization for all MSI files processed by applications leveraging Open Babel, especially when dealing with untrusted sources, to prevent malformed records from reaching the vulnerable parser.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected crashes or abnormal termination of the \u003ccode\u003eobabel\u003c/code\u003e CLI tool or any applications using the \u003ccode\u003eOBConversion\u003c/code\u003e API when processing MSI files, as this could indicate an attempted exploitation of CVE-2022-44451.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-03T12:51:24Z","date_published":"2026-07-03T12:51:24Z","id":"https://feed.craftedsignal.io/briefs/2026-07-open-babel-msi-parser-vuln/","summary":"A memory-safety vulnerability (CVE-2022-44451) in Open Babel's MSI parser allows for an uninitialized pointer dereference when processing a specially crafted MSI input file, affecting versions prior to 3.2.0 and potentially leading to application instability or denial of service when a victim opens a malicious file.","title":"Open Babel Has Uninitialized Pointer Dereference in MSI Atom Parser","url":"https://feed.craftedsignal.io/briefs/2026-07-open-babel-msi-parser-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - Chemistry","version":"https://jsonfeed.org/version/1.1"}