Every CVE Search/ Get API key

CVE-2025-10999

Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereference

4.8 MediumFix available

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.25%Up 0.2 points since Sep 26, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.8

Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereference

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Record
CVE-2025-10999
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR
Weakness
CWE-476, CWE-404
Updated
2026-11-02
EUVDEUVD-2025-31187 4.8

Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Record
EUVD-2025-31187
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-55j6-rjhx-hwfh 5.5

Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Summary

A memory-safety vulnerability in Open Babel's CACAO parser caused a NULL pointer dereference when reading a crafted input file.

Details

The flaw was in CacaoFormat::SetHilderbrandt. A malformed input caused the parser to dereference a NULL pointer while applying the Hilderbrandt transformation.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CACAO file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/ecaed96f Originally reported as #2827; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

Record
GHSA-55j6-rjhx-hwfh
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-404, CWE-476
Updated
2026-11-02
GitHub AdvisoriesGHSA-62mq-grc2-53j3 1.9

Duplicate Advisory: Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-55j6-rjhx-hwfh. This link is maintained to preserve external references.

Original Description

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Record
GHSA-62mq-grc2-53j3
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
NVD 1.9

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Record
CVE-2025-10999
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSV 1.9

Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereference

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Record
CVE-2025-10999
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-404, CWE-476
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2025-10999 5.5

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Record
DEBIAN-CVE-2025-10999
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-55j6-rjhx-hwfh 5.5

Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Summary

A memory-safety vulnerability in Open Babel's CACAO parser caused a NULL pointer dereference when reading a crafted input file.

Details

The flaw was in CacaoFormat::SetHilderbrandt. A malformed input caused the parser to dereference a NULL pointer while applying the Hilderbrandt transformation.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CACAO file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/ecaed96f Originally reported as #2827; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

Record
GHSA-55j6-rjhx-hwfh
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-404, CWE-476
Updated
2026-11-02
OSVGHSA-62mq-grc2-53j3 1.9

Duplicate Advisory: Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-55j6-rjhx-hwfh. This link is maintained to preserve external references.

Original Description

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Record
GHSA-62mq-grc2-53j3
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-404
Updated
2026-11-02
OSVPYSEC-2026-2772 5.5

Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Summary

A memory-safety vulnerability in Open Babel's CACAO parser caused a NULL pointer dereference when reading a crafted input file.

Details

The flaw was in CacaoFormat::SetHilderbrandt. A malformed input caused the parser to dereference a NULL pointer while applying the Hilderbrandt transformation.

Impact

Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious CACAO file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C#, PHP).

Affected versions

All releases up to and including 3.1.1.

Patched version

3.2.0 (released 2026-05-26).

Patch

Fix commit: https://github.com/openbabel/openbabel/commit/ecaed96f Originally reported as #2827; fixes consolidated in #2913.

A minimized reproducer for this CVE is checked in under test/files/fuzz_regress/ and is exercised on every CI build under ASAN+UBSAN by the fuzzregresstest harness.

Credit

Reported via OSS-Fuzz.

Record
PYSEC-2026-2772
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-10999 1.9

A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.

Record
UBUNTU-CVE-2025-10999
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:10936-1 No score

libopenbabel8-3.2.0-1.1 on GA media

These are all security issues fixed in the libopenbabel8-3.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10936-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21190-1 No score

Security update for openbabel

This update for openbabel fixes the following issues:

Changes in openbabel:

  • Update to version 3.2.0:
    • Add an L-BFGS optimizer, used by default for gen3d and conformer searches
    • New macrocycle ring builder (Dale codes) for better initial 3D geometry of large rings
    • Add KET (Ketcher JSON) and ChemicalJSON (.cjson) format support
    • Drop Python 2 support; Python 3.13 supported
    • Faster, vectorized distance-geometry implementation
    • Full CMake 4 compatibility and modernized build
    • Backwards compatible with 3.0 and 3.1
    • Fix many crash and memory-safety bugs found via OSS-Fuzz and TALOS, including the following security issues: CVE-2022-37331 (boo#1217676), CVE-2022-41793, CVE-2022-42885, CVE-2022-43467, CVE-2022-43607, CVE-2022-44451, CVE-2022-46280, CVE-2022-46289, CVE-2022-46290, CVE-2022-46291, CVE-2022-46292, CVE-2022-46294, CVE-2022-46295, CVE-2025-10994, CVE-2025-10995, CVE-2025-10996, CVE-2025-10997, CVE-2025-10998, CVE-2025-10999, CVE-2025-11000, CVE-2026-2704 (boo#1258501), CVE-2026-2705 (boo#1258507) and CVE-2026-3408 (boo#1259041)
Record
openSUSE-SU-2026:21190-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openbabel
PyPI
 before 3.2.0
3.2.0
openbabel
Debian:12
 All versions, plus listed versions
3.1.1+dfsg-103.1.1+dfsg-113.1.1+dfsg-123.1.1+dfsg-133.1.1+dfsg-14
Show 4 moreShow less
3.1.1+dfsg-15~exp3.1.1+dfsg-93.2.0+dfsg-13.2.0+dfsg-1~exp
 None known
openbabel
Debian:13
 All versions, plus listed versions
3.1.1+dfsg-123.1.1+dfsg-133.1.1+dfsg-143.1.1+dfsg-15~exp3.2.0+dfsg-13.2.0+dfsg-1~exp
 None known
openbabel
Debian:14
 All versions, plus listed versions
3.1.1+dfsg-123.1.1+dfsg-133.1.1+dfsg-143.1.1+dfsg-15~exp3.2.0+dfsg-13.2.0+dfsg-1~exp
 None known
openbabel
PyPI
 before 3.2.0, plus listed versions
1.81.8.11.8.21.8.31.8.4
Show 6 moreShow less
2.4.02.4.13.0.03.0.0a13.1.13.1.1.1
3.2.0
openbabel
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.3.2+dfsg-2.22.3.2+dfsg-2.2build1
 None known
openbabel
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.3.2+dfsg-3build1
 None known
openbabel
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.4.1+dfsg-32.4.1+dfsg-3build12.4.1+dfsg-5.12.4.1+dfsg-63.0.0+dfsg-33.0.0+dfsg-3ubuntu3
 None known
openbabel
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.1.1+dfsg-6ubuntu13.1.1+dfsg-6ubuntu5
 None known
openbabel
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.1.1+dfsg-9build23.1.1+dfsg-9ubuntu13.1.1+dfsg-9ubuntu23.1.1+dfsg-9ubuntu43.1.1+dfsg-9ubuntu5
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
openbabel
Ubuntu:25.10
 All versions, plus listed versions
3.1.1+dfsg-11ubuntu33.1.1+dfsg-11ubuntu4
 None known
openbabel
Ubuntu:26.10
 All versions, plus listed versions
3.1.1+dfsg-11ubuntu53.1.1+dfsg-14ubuntu2
 None known
openbabel
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.1.1+dfsg-11ubuntu43.1.1+dfsg-11ubuntu5
 None known
openbabel
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 3.2.0-1.1
3.2.0-1.1
openbabel
openSUSE:Leap 16.0
From an advisory covering 23 CVEs
 before 3.2.0-bp160.1.1
3.2.0-bp160.1.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-10999 is a medium vulnerability (CVSS 4.8) in Openbabel Open Babel, published September 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in openbabel 3.2.0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open