Every CVE Search/ Get API key

CVE-2025-10998

Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference

4.8 MediumFix available

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.21%Up 0.2 points since Sep 26, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.8

Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Record
CVE-2025-10998
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR
Weakness
CWE-476, CWE-404
Updated
2026-11-02
EUVDEUVD-2025-31188 4.8

Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Record
EUVD-2025-31188
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-hvp2-4h2f-26w4 1.9

Duplicate Advisory: Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-j9pp-7wfg-q7fj. This link is maintained to preserve external references.

Original Description

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Record
GHSA-hvp2-4h2f-26w4
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
GitHub AdvisoriesGHSA-j9pp-7wfg-q7fj 1.9

Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Summary

A memory-safety vulnerability in Open Babel's ChemKin parser caused a NULL pointer dereference when reading a crafted input file.

Details

The flaw was in ChemKinFormat::ReadReactionQualifierLines. A malformed reaction qualifier record caused the parser to dereference a NULL pointer.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious ChemKin file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/af4a4212 Originally reported as #2829; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

Record
GHSA-j9pp-7wfg-q7fj
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-404, CWE-476
Updated
2026-11-02
NVD 1.9

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Record
CVE-2025-10998
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSV 1.9

Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Record
CVE-2025-10998
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2025-10998 5.5

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Record
DEBIAN-CVE-2025-10998
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-hvp2-4h2f-26w4 1.9

Duplicate Advisory: Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-j9pp-7wfg-q7fj. This link is maintained to preserve external references.

Original Description

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Record
GHSA-hvp2-4h2f-26w4
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
OSVGHSA-j9pp-7wfg-q7fj 1.9

Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Summary

A memory-safety vulnerability in Open Babel's ChemKin parser caused a NULL pointer dereference when reading a crafted input file.

Details

The flaw was in ChemKinFormat::ReadReactionQualifierLines. A malformed reaction qualifier record caused the parser to dereference a NULL pointer.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious ChemKin file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/af4a4212 Originally reported as #2829; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

Record
GHSA-j9pp-7wfg-q7fj
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSVPYSEC-2026-2782 1.9

Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Summary

A memory-safety vulnerability in Open Babel's ChemKin parser caused a NULL pointer dereference when reading a crafted input file.

Details

The flaw was in ChemKinFormat::ReadReactionQualifierLines. A malformed reaction qualifier record caused the parser to dereference a NULL pointer.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious ChemKin file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/af4a4212 Originally reported as #2829; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

Record
PYSEC-2026-2782
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-10998 1.9

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Record
UBUNTU-CVE-2025-10998
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:21190-1 No score

Security update for openbabel

This update for openbabel fixes the following issues:

Changes in openbabel:

  • Update to version 3.2.0:
    • Add an L-BFGS optimizer, used by default for gen3d and conformer searches
    • New macrocycle ring builder (Dale codes) for better initial 3D geometry of large rings
    • Add KET (Ketcher JSON) and ChemicalJSON (.cjson) format support
    • Drop Python 2 support; Python 3.13 supported
    • Faster, vectorized distance-geometry implementation
    • Full CMake 4 compatibility and modernized build
    • Backwards compatible with 3.0 and 3.1
    • Fix many crash and memory-safety bugs found via OSS-Fuzz and TALOS, including the following security issues: CVE-2022-37331 (boo#1217676), CVE-2022-41793, CVE-2022-42885, CVE-2022-43467, CVE-2022-43607, CVE-2022-44451, CVE-2022-46280, CVE-2022-46289, CVE-2022-46290, CVE-2022-46291, CVE-2022-46292, CVE-2022-46294, CVE-2022-46295, CVE-2025-10994, CVE-2025-10995, CVE-2025-10996, CVE-2025-10997, CVE-2025-10998, CVE-2025-10999, CVE-2025-11000, CVE-2026-2704 (boo#1258501), CVE-2026-2705 (boo#1258507) and CVE-2026-3408 (boo#1259041)
Record
openSUSE-SU-2026:21190-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openbabel
PyPI
 before 3.2.0
3.2.0
openbabel
Debian:12
 All versions, plus listed versions
3.1.1+dfsg-103.1.1+dfsg-113.1.1+dfsg-123.1.1+dfsg-133.1.1+dfsg-14
Show 4 moreShow less
3.1.1+dfsg-15~exp3.1.1+dfsg-93.2.0+dfsg-13.2.0+dfsg-1~exp
 None known
openbabel
Debian:13
 All versions, plus listed versions
3.1.1+dfsg-123.1.1+dfsg-133.1.1+dfsg-143.1.1+dfsg-15~exp3.2.0+dfsg-13.2.0+dfsg-1~exp
 None known
openbabel
Debian:14
 All versions, plus listed versions
3.1.1+dfsg-123.1.1+dfsg-133.1.1+dfsg-143.1.1+dfsg-15~exp3.2.0+dfsg-13.2.0+dfsg-1~exp
 None known
openbabel
PyPI
 before 3.2.0, plus listed versions
1.81.8.11.8.21.8.31.8.4
Show 6 moreShow less
2.4.02.4.13.0.03.0.0a13.1.13.1.1.1
3.2.0
openbabel
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.3.2+dfsg-2.22.3.2+dfsg-2.2build1
 None known
openbabel
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.3.2+dfsg-3build1
 None known
openbabel
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.4.1+dfsg-32.4.1+dfsg-3build12.4.1+dfsg-5.12.4.1+dfsg-63.0.0+dfsg-33.0.0+dfsg-3ubuntu3
 None known
openbabel
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.1.1+dfsg-6ubuntu13.1.1+dfsg-6ubuntu5
 None known
openbabel
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.1.1+dfsg-9build23.1.1+dfsg-9ubuntu13.1.1+dfsg-9ubuntu23.1.1+dfsg-9ubuntu43.1.1+dfsg-9ubuntu5
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
openbabel
Ubuntu:25.10
 All versions, plus listed versions
3.1.1+dfsg-11ubuntu33.1.1+dfsg-11ubuntu4
 None known
openbabel
Ubuntu:26.10
 All versions, plus listed versions
3.1.1+dfsg-11ubuntu53.1.1+dfsg-14ubuntu2
 None known
openbabel
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.1+dfsg-11ubuntu43.1.1+dfsg-11ubuntu5
 None known
openbabel
openSUSE:Leap 16.0
From an advisory covering 23 CVEs
 before 3.2.0-bp160.1.1
3.2.0-bp160.1.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-10998 is a medium vulnerability (CVSS 4.8) in Openbabel Open Babel, published September 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in openbabel 3.2.0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open