Open-Babel - CraftedSignal Threat Feed

Open Babel Uninitialized Pointer Dereference Vulnerability (CVE-2022-42885)

hello@craftedsignal.io — Fri, 03 Jul 2026 12:54:02 +0000

Open Babel, a widely used C++ library and CLI tool for chemical file format conversions, is affected by a high-severity memory-safety vulnerability, CVE-2022-42885. Discovered in the GRO residue parser, this flaw allows an uninitialized pointer dereference when processing a specially crafted GRO input file. The vulnerability affects all versions up to and including 3.1.1 and was publicly disclosed with a patch in version 3.2.0 on May 26, 2026. Reported by Cisco TALOS, this issue impacts systems where Open Babel's obabel tool, OBConversion API, or its various language bindings (Python, Ruby, Java, R, Perl, C#, PHP) are used to parse untrusted GRO files. Exploitation can lead to application crashes or potentially arbitrary code execution, posing a significant risk to data processing workflows in chemistry and related scientific fields.

Attack Chain

An attacker crafts a malicious GRO file specifically designed with a malformed residue record to exploit CVE-2022-42885.
The attacker delivers this malicious GRO file to a target system, potentially via social engineering tactics such as email attachment or by embedding it within a seemingly legitimate data set.
A user or an automated process on the target system opens or attempts to parse the malicious GRO file using the obabel CLI tool, an application leveraging Open Babel's OBConversion API, or one of its language bindings (e.g., Python, Java).
During the parsing of the malformed record, Open Babel's GRO reader attempts to access a residue pointer that has not been properly initialized.
This uninitialized pointer dereference leads to a memory access violation within the process.
The memory access violation results in the application crashing (denial of service) or, in a more severe scenario, allows the attacker to achieve arbitrary code execution on the host system.

Impact

This vulnerability impacts systems that utilize Open Babel, particularly those that process GRO chemical file format data from untrusted sources. Since Open Babel is commonly shipped by Linux distributions and embedded in scientific services, a broad range of research institutions, academic organizations, and industrial entities could be affected. Successful exploitation via CVE-2022-42885 leads to immediate application termination, causing denial of service for any service or tool relying on Open Babel's GRO parsing. More critically, skilled attackers could potentially leverage this memory corruption to achieve arbitrary code execution on the compromised system, allowing for data exfiltration, further system compromise, or the deployment of additional malicious payloads.

Recommendation

Immediately update all installations of Open Babel to version 3.2.0 or newer to patch CVE-2022-42885.
Implement strict input validation and sandboxing for applications that process untrusted or user-supplied GRO files using Open Babel.
Educate users on the risks of opening or processing untrusted files, consistent with the initial access vector that requires a victim to open a malicious GRO file.

Open Babel PQS coord_file parser suffers from out-of-bounds write vulnerability (CVE-2022-43467)

hello@craftedsignal.io — Fri, 03 Jul 2026 12:53:09 +0000

A high-severity memory-safety vulnerability, identified as CVE-2022-43467, has been discovered in Open Babel's PQS coord_file parser. This flaw affects all versions up to and including 3.1.1 of the Open Babel library and CLI tool, which is critical for processing various chemistry file formats. Exploitation occurs when a victim processes a specially crafted PQS file, leading to an out-of-bounds write within the coord_file parsing path. This vulnerability was reported by Cisco TALOS and subsequently patched in version 3.2.0, released on 2026-05-26. Given Open Babel's widespread use across Linux distributions and in services that handle untrusted input, this flaw poses a significant risk of arbitrary code execution or denial of service.

Attack Chain

An attacker crafts a specially designed PQS file containing a malformed coord_file specifier that targets the vulnerability.
The attacker delivers this malicious PQS file to a target system or user, often via email, download, or integration into a workflow.
A user or automated service on the victim system opens and processes the malicious PQS file using an affected Open Babel component (e.g., obabel CLI tool, OBConversion API, or language bindings).
During the parsing process of the PQS coord_file path, the malformed specifier triggers an out-of-bounds write operation.
This memory corruption overwrites adjacent memory regions, leading to unpredictable program behavior, including crashes.
Successful exploitation can result in application crashes (Denial of Service) or, with further exploitation, arbitrary code execution on the compromised system.

Impact

The vulnerability affects any system or service utilizing Open Babel versions up to 3.1.1 to process PQS files, particularly those that handle untrusted or external input. Open Babel is widely deployed as a C++ library and command-line interface, integrated into Linux distributions and various scientific applications. Successful exploitation of CVE-2022-43467 can lead to service disruption through denial of service (application crashes) or, more severely, arbitrary code execution, allowing attackers to gain control over affected systems. The full scope of potential victims is broad due to the library's foundational role in chemistry informatics.

Recommendation

Immediately update all Open Babel installations to version 3.2.0 or later to patch CVE-2022-43467.
For Python environments, ensure pip/openbabel is updated to a version greater than or equal to 3.2.0.
Implement strict input validation for all PQS files processed by Open Babel components, especially those originating from untrusted sources, to mitigate the risk of malformed file attacks.

Open Babel Has Uninitialized Pointer Dereference in MSI Atom Parser

hello@craftedsignal.io — Fri, 03 Jul 2026 12:51:24 +0000

A memory-safety vulnerability, identified as CVE-2022-44451, has been discovered in Open Babel, a widely used C++ library and command-line interface for chemistry file format manipulation. Reported by Cisco TALOS, this flaw exists within Open Babel's MSI atom parser, leading to an uninitialized pointer dereference when processing a specially crafted input file. This vulnerability affects all Open Babel versions up to and including 3.1.1. Attackers could exploit this by convincing a victim to open a malicious MSI file using the obabel CLI tool, the OBConversion API, or any of its language bindings (Python, Ruby, Java, R, Perl, C#, PHP). This could lead to application instability, crashes, or denial of service on systems that parse untrusted chemical file formats, impacting scientific computing environments and services embedding the library.

Attack Chain

An attacker crafts a malicious MSI (Molecular Structure Input) file specifically designed to trigger the uninitialized pointer dereference vulnerability (CVE-2022-44451) within Open Babel's parser.
The attacker delivers this malicious MSI file to a target system or user, potentially through phishing emails, malicious websites, or embedding it within a seemingly legitimate data set.
The victim opens or attempts to process the malicious MSI file using the obabel command-line tool, an application leveraging the OBConversion API, or any of Open Babel's language bindings (e.g., Python, Ruby).
Open Babel's internal MSI parser begins to process the malformed record within the crafted input file.
During atom handling, the parser attempts to dereference an atom pointer that has not been properly initialized, triggering the memory-safety flaw.
This uninitialized pointer dereference causes the Open Babel application or the service embedding it to crash or become unstable.
The final objective is application denial of service or potential arbitrary code execution, impacting the availability and integrity of the affected system.

Impact

This vulnerability primarily results in application instability or denial of service, as the affected Open Babel process crashes when attempting to parse a malicious MSI file. Given Open Babel's role as a core library and CLI tool shipped by various Linux distributions and embedded in services that process chemical file formats, a successful attack could disrupt scientific computing workflows, research data processing, or any service relying on Open Babel for untrusted input parsing. While no specific victim counts are available, the broad usage of Open Babel implies a significant potential attack surface across academic, research, and industrial sectors utilizing computational chemistry.

Recommendation

Immediately update Open Babel installations to version 3.2.0 or newer to mitigate CVE-2022-44451, as indicated by the Patched version details.
Implement robust input validation and sanitization for all MSI files processed by applications leveraging Open Babel, especially when dealing with untrusted sources, to prevent malformed records from reaching the vulnerable parser.
Monitor for unexpected crashes or abnormal termination of the obabel CLI tool or any applications using the OBConversion API when processing MSI files, as this could indicate an attempted exploitation of CVE-2022-44451.