Open Babel has out-of-bounds write in Gaussian coords_type orientation parser
Summary
A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write when reading a crafted input file.
Details
The flaw was in the coords_type orientation parser inside the
Gaussian output reader. A malformed orientation block caused the
parser to write past the end of its destination buffer.
Impact
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious Gaussian output file with the
obabel tool, the OBConversion API, or any of the language
bindings (Python, Ruby, Java, R, Perl, C#, PHP).
Affected versions
All releases up to and including 3.1.1.
Patched version
3.2.0 (released 2026-05-26).
Patch
Fix commit: https://github.com/openbabel/openbabel/commit/528c142f
A minimized reproducer for this CVE is checked in under
test/files/fuzz_regress/ and is exercised on every CI build under
ASAN+UBSAN by the fuzzregresstest harness.
Credit
Reported by Cisco TALOS.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | openbabel | < 3.2.0 | 3.2.0 |
References
- https://github.com/openbabel/openbabel/security/advisories/GHSA-vr3p-gg26-45v9
- https://nvd.nist.gov/vuln/detail/CVE-2022-37331
- https://github.com/openbabel/openbabel/commit/528c142f
- https://github.com/openbabel/openbabel
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1672
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1672
- https://pypi.org/project/openbabel
- https://github.com/advisories/GHSA-vr3p-gg26-45v9
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-119, CWE-787- Platform
- Python (PyPI)
- Package
openbabel- Disclosed
- 01.07.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2793 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vr3p-gg26-45v9 - CC BY 4.0
Vulnerability history: openbabel
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 24
- First → latest
- 06.2026 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 16
- Medium 2
- Low 6
Disclosures per year
- 2026: 24
-
Open Babel has out-of-bounds write in Gaussian coords_type orientation parser this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.