https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 03:16:44 +0000 https://cve.radiocsirt.org/vuln/cve-2026-2705 <p><strong>Affected:</strong> Open Babel</p> <p>A vulnerability was detected in Open Babel up to 3.1.1. The impacted element is the function OBAtom::SetFormalCharge in the library include/openbabel/atom.h of the component MOL2 File Handler. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.</p> <p><strong>Affected:</strong> Open Babel</p> <p>A vulnerability was detected in Open Babel up to 3.1.1. The impacted element is the function OBAtom::SetFormalCharge in the library include/openbabel/atom.h of the component MOL2 File Handler. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.</p> https://cve.radiocsirt.org/vuln/cve-2026-2705 https://cve.radiocsirt.org/vuln/ghsa-4w5w-4fhm-q483 <p><strong>Affected:</strong> PyPI: openbabel</p> <p>### Summary</p> <p>A memory-safety vulnerability in Open Babel&#39;s MOL2 file format parser caused a NULL pointer dereference when reading a crafted input file.</p> <p>### Details</p> <p>The flaw was in `OBAtom::SetFormalCharge` as called from the MOL2 parser. A malformed atom record caused the parser to call the method on a NULL atom pointer.</p> <p>### Impact</p> <p>Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOL2 file with the `obabel` tool, the `OBConversion` API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).</p> <p>### Affected versions</p> <p>All releases up to and including 3.1.1.</p> <p>### Patched version</p> <p>3.2.0 (released 2026-05-26).</p> <p>### Patch</p> <p>Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b Tracked in #2862.</p> <p>A minimized reproducer for this CVE is checked in under `test/files/fuzz_regress/` and is exercised on every CI build under ASAN+UBSAN by the `fuzzregresstest` harness.</p> <p>### Credit</p> <p>Reported by Vedant Madane (@VedantMadane) via VulDB.</p> <p><strong>Affected:</strong> PyPI: openbabel</p> <p>### Summary</p> <p>A memory-safety vulnerability in Open Babel&#39;s MOL2 file format parser caused a NULL pointer dereference when reading a crafted input file.</p> <p>### Details</p> <p>The flaw was in `OBAtom::SetFormalCharge` as called from the MOL2 parser. A malformed atom record caused the parser to call the method on a NULL atom pointer.</p> <p>### Impact</p> <p>Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOL2 file with the `obabel` tool, the `OBConversion` API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).</p> <p>### Affected versions</p> <p>All releases up to and including 3.1.1.</p> <p>### Patched version</p> <p>3.2.0 (released 2026-05-26).</p> <p>### Patch</p> <p>Fix commit: https://github.com/openbabel/openbabel/commit/e23a224b Tracked in #2862.</p> <p>A minimized reproducer for this CVE is checked in under `test/files/fuzz_regress/` and is exercised on every CI build under ASAN+UBSAN by the `fuzzregresstest` harness.</p> <p>### Credit</p> <p>Reported by Vedant Madane (@VedantMadane) via VulDB.</p> https://cve.radiocsirt.org/vuln/ghsa-4w5w-4fhm-q483