CVE-2025-10996

A vulnerability was detected in Open Babel up to 3.1.1. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit is now public and may be used.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-j35x-w4gj-pf7w. This link is maintained to preserve external references.

Original Description

A vulnerability was detected in Open Babel up to 3.1.1. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit is now public and may be used.

Summary

A memory-safety vulnerability in Open Babel's SMILES parser caused a heap buffer overflow when reading a crafted input string.

Details

The flaw was in OBSmilesParser::ParseSmiles. A malformed SMILES input caused the parser to write past the end of a heap-allocated buffer.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to parse a malicious SMILES string with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). SMILES strings are commonly passed on the command line and through scripted pipelines, so this primitive is especially reachable.

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/b34cd604 Originally reported as #2831; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

Summary

A memory-safety vulnerability in Open Babel's SMILES parser caused a heap buffer overflow when reading a crafted input string.

Details

The flaw was in OBSmilesParser::ParseSmiles. A malformed SMILES input caused the parser to write past the end of a heap-allocated buffer.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to parse a malicious SMILES string with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP). SMILES strings are commonly passed on the command line and through scripted pipelines, so this primitive is especially reachable.

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/b34cd604 Originally reported as #2831; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

A vulnerability was detected in Open Babel up to 3.1.1. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit is now public and may be used.

These are all security issues fixed in the libopenbabel8-3.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for openbabel fixes the following issues:

Changes in openbabel:

• Update to version 3.2.0:
  • Add an L-BFGS optimizer, used by default for gen3d and conformer searches
  • New macrocycle ring builder (Dale codes) for better initial 3D geometry of large rings
  • Add KET (Ketcher JSON) and ChemicalJSON (.cjson) format support
  • Drop Python 2 support; Python 3.13 supported
  • Faster, vectorized distance-geometry implementation
  • Full CMake 4 compatibility and modernized build
  • Backwards compatible with 3.0 and 3.1
  • Fix many crash and memory-safety bugs found via OSS-Fuzz and TALOS, including the following security issues: CVE-2022-37331 (boo#1217676), CVE-2022-41793, CVE-2022-42885, CVE-2022-43467, CVE-2022-43607, CVE-2022-44451, CVE-2022-46280, CVE-2022-46289, CVE-2022-46290, CVE-2022-46291, CVE-2022-46292, CVE-2022-46294, CVE-2022-46295, CVE-2025-10994, CVE-2025-10995, CVE-2025-10996, CVE-2025-10997, CVE-2025-10998, CVE-2025-10999, CVE-2025-11000, CVE-2026-2704 (boo#1258501), CVE-2026-2705 (boo#1258507) and CVE-2026-3408 (boo#1259041)