{"id":"CVE-2025-10994","aliases":["DEBIAN-CVE-2025-10994","EUVD-2025-31200","GHSA-5fgf-q57f-wwqf","GHSA-pp85-5j63-xpq3","PYSEC-2026-2789","UBUNTU-CVE-2025-10994","openSUSE-SU-2026:11259-1","openSUSE-SU-2026:21190-1"],"status":"published","title":"Open Babel gamessformat.cpp ReadMolecule use after free","description":"A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00251,"percentile":0.16588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-416"],"published":"2025-09-26T02:02:07.422Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"PyPI","package":"openbabel","fixed_in":["3.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openbabel","fixed_in":["3.2.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-10","3.1.1+dfsg-11","3.1.1+dfsg-12","3.1.1+dfsg-13","3.1.1+dfsg-14","3.1.1+dfsg-15~exp","3.1.1+dfsg-9","3.2.0+dfsg-1","3.2.0+dfsg-1~exp"]},{"source":"osv","ecosystem":"Debian:13","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-12","3.1.1+dfsg-13","3.1.1+dfsg-14","3.1.1+dfsg-15~exp","3.2.0+dfsg-1","3.2.0+dfsg-1~exp"]},{"source":"osv","ecosystem":"Debian:14","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-12","3.1.1+dfsg-13","3.1.1+dfsg-14","3.1.1+dfsg-15~exp","3.2.0+dfsg-1","3.2.0+dfsg-1~exp"]},{"source":"osv","ecosystem":"PyPI","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["1.8","1.8.1","1.8.2","1.8.3","1.8.4","2.4.0","2.4.1","3.0.0","3.0.0a1","3.1.1","3.1.1.1"]},{"source":"osv","ecosystem":"PyPI","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["1.8","1.8.1","1.8.2","1.8.3","1.8.4","2.4.0","2.4.1","3.0.0","3.0.0a1","3.1.1","3.1.1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2+dfsg-2.2","2.3.2+dfsg-2.2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg-3","2.4.1+dfsg-3build1","2.4.1+dfsg-5.1","2.4.1+dfsg-6","3.0.0+dfsg-3","3.0.0+dfsg-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-6ubuntu1","3.1.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-9build2","3.1.1+dfsg-9ubuntu1","3.1.1+dfsg-9ubuntu2","3.1.1+dfsg-9ubuntu4","3.1.1+dfsg-9ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-11ubuntu3","3.1.1+dfsg-11ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-11ubuntu5","3.1.1+dfsg-14ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-11ubuntu4","3.1.1+dfsg-11ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-bp160.1.1"}]}],"bundled":23}],"products":[{"vendor":"openbabel","product":"open_babel"}],"references":[{"url":"https://vuldb.com/?id.325922","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://vuldb.com/?ctiid.325922","tags":["signature","permissions-required","Permissions Required","VDB Entry","report","web"]},{"url":"https://vuldb.com/?submit.654057","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://github.com/openbabel/openbabel/issues/2834","tags":["issue-tracking","Exploit","Issue Tracking","report","web"]},{"url":"https://github.com/user-attachments/files/22318611/poc.zip","tags":["exploit","Exploit","evidence","web","report"]},{"url":"https://github.com/openbabel/openbabel/security/advisories/GHSA-pp85-5j63-xpq3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10994","tags":["advisory"]},{"url":"https://github.com/openbabel/openbabel/commit/95033d27d23c07f98daa92d3cd3ae5ea07594a91","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5fgf-q57f-wwqf"},{"url":"https://github.com/advisories/GHSA-pp85-5j63-xpq3","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10994.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-10994","tags":["advisory"]},{"url":"https://github.com/openbabel/openbabel","tags":["package"]},{"url":"https://pypi.org/project/openbabel","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-10994","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10994","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10994","tags":["web"]},{"url":"https://bugzilla.suse.com/1217676","tags":["report"]},{"url":"https://bugzilla.suse.com/1258501","tags":["report"]},{"url":"https://bugzilla.suse.com/1258507","tags":["report"]},{"url":"https://bugzilla.suse.com/1259041","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3408","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-10994","title":"Open Babel gamessformat.cpp ReadMolecule use after free","description":"A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","status":"published","published":"2025-09-26T02:02:07.422Z","modified":"2025-09-26T19:26:09.605Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"2.0","score":4.3,"vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-416","CWE-119"],"updated_at":"2026-11-02T14:32:30.9782Z"}],"euvd":[{"id":"EUVD-2025-31200","description":"Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule","status":"published","published":"2026-06-30T18:48:57Z","modified":"2026-06-30T18:48:57Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T18:20:21.147551Z"}],"ghsa":[{"id":"GHSA-5fgf-q57f-wwqf","title":"Duplicate Advisory: Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pp85-5j63-xpq3. This link is maintained to preserve external references.\n\n## Original Description\nA weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","status":"withdrawn","published":"2025-09-26T03:31:07Z","modified":"2026-06-30T18:48:52Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:40:35.701766Z"},{"id":"GHSA-pp85-5j63-xpq3","title":"Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule","description":"### Summary\n\nA memory-safety vulnerability in Open Babel's GAMESS output parser\ncaused a use-after-free when reading a crafted input file.\n\n### Details\n\nThe flaw was in `GAMESSOutputFormat::ReadMolecule`. A malformed input\ncaused the parser to dereference a stale pointer after the underlying\nobject had been freed.\n\n### Impact\n\nOpen Babel is a C++ library and CLI used to read and write chemistry\nfile formats; it is shipped by Linux distributions and embedded in\nservices that may parse untrusted input. Triggering this vulnerability\nrequires the victim to open a malicious GAMESS output file with the\n`obabel` tool, the `OBConversion` API, or any of the language\nbindings (Python, Ruby, Java, R, Perl, C#, PHP).\n\n### Affected versions\n\nAll releases up to and including 3.1.1.\n\n### Patched version\n\n3.2.0 (released 2026-05-26).\n\n### Patch\n\nFix commit: https://github.com/openbabel/openbabel/commit/95033d27\nOriginally reported as #2834; fixes consolidated in #2913.\n\nA minimized reproducer for this CVE is checked in under\n`test/files/fuzz_regress/` and is exercised on every CI build under\nASAN+UBSAN by the `fuzzregresstest` harness.\n\n### Credit\n\nReported via OSS-Fuzz.","status":"published","published":"2026-06-30T18:48:57Z","modified":"2026-06-30T18:48:58Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-416"],"updated_at":"2026-11-02T14:40:35.701766Z"}],"nvd":[{"id":"CVE-2025-10994","description":"A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","status":"published","published":"2025-09-26T02:15:52.1Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-119","CWE-416"],"updated_at":"2026-11-02T14:11:33.36253Z"}],"osv":[{"id":"CVE-2025-10994","title":"Open Babel gamessformat.cpp ReadMolecule use after free","description":"A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","status":"published","published":"2025-09-26T02:02:07.422Z","modified":"2026-10-28T02:31:00.447177136Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-119","CWE-416"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"DEBIAN-CVE-2025-10994","description":"A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","status":"published","published":"2025-09-26T02:15:52.1Z","modified":"2026-10-23T18:04:32.737277439Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-5fgf-q57f-wwqf","title":"Duplicate Advisory: Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pp85-5j63-xpq3. This link is maintained to preserve external references.\n\n## Original Description\nA weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","status":"withdrawn","published":"2025-09-26T03:31:07Z","modified":"2026-06-30T19:00:30.969695803Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-pp85-5j63-xpq3","title":"Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule","description":"### Summary\n\nA memory-safety vulnerability in Open Babel's GAMESS output parser\ncaused a use-after-free when reading a crafted input file.\n\n### Details\n\nThe flaw was in `GAMESSOutputFormat::ReadMolecule`. A malformed input\ncaused the parser to dereference a stale pointer after the underlying\nobject had been freed.\n\n### Impact\n\nOpen Babel is a C++ library and CLI used to read and write chemistry\nfile formats; it is shipped by Linux distributions and embedded in\nservices that may parse untrusted input. Triggering this vulnerability\nrequires the victim to open a malicious GAMESS output file with the\n`obabel` tool, the `OBConversion` API, or any of the language\nbindings (Python, Ruby, Java, R, Perl, C#, PHP).\n\n### Affected versions\n\nAll releases up to and including 3.1.1.\n\n### Patched version\n\n3.2.0 (released 2026-05-26).\n\n### Patch\n\nFix commit: https://github.com/openbabel/openbabel/commit/95033d27\nOriginally reported as #2834; fixes consolidated in #2913.\n\nA minimized reproducer for this CVE is checked in under\n`test/files/fuzz_regress/` and is exercised on every CI build under\nASAN+UBSAN by the `fuzzregresstest` harness.\n\n### Credit\n\nReported via OSS-Fuzz.","status":"published","published":"2026-06-30T18:48:57Z","modified":"2026-07-13T16:43:51.116522277Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-119","CWE-416"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"PYSEC-2026-2789","title":"Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule","description":"### Summary\n\nA memory-safety vulnerability in Open Babel's GAMESS output parser\ncaused a use-after-free when reading a crafted input file.\n\n### Details\n\nThe flaw was in `GAMESSOutputFormat::ReadMolecule`. A malformed input\ncaused the parser to dereference a stale pointer after the underlying\nobject had been freed.\n\n### Impact\n\nOpen Babel is a C++ library and CLI used to read and write chemistry\nfile formats; it is shipped by Linux distributions and embedded in\nservices that may parse untrusted input. Triggering this vulnerability\nrequires the victim to open a malicious GAMESS output file with the\n`obabel` tool, the `OBConversion` API, or any of the language\nbindings (Python, Ruby, Java, R, Perl, C#, PHP).\n\n### Affected versions\n\nAll releases up to and including 3.1.1.\n\n### Patched version\n\n3.2.0 (released 2026-05-26).\n\n### Patch\n\nFix commit: https://github.com/openbabel/openbabel/commit/95033d27\nOriginally reported as #2834; fixes consolidated in #2913.\n\nA minimized reproducer for this CVE is checked in under\n`test/files/fuzz_regress/` and is exercised on every CI build under\nASAN+UBSAN by the `fuzzregresstest` harness.\n\n### Credit\n\nReported via OSS-Fuzz.","status":"published","published":"2026-07-13T15:46:25.44917Z","modified":"2026-07-13T16:32:26.297892391Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"UBUNTU-CVE-2025-10994","description":"A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.","status":"published","published":"2025-09-26T02:15:00Z","modified":"2026-10-17T12:56:47.49207843Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"openSUSE-SU-2026:11259-1","title":"libopenbabel8-3.2.1-1.1 on GA media","description":"These are all security issues fixed in the libopenbabel8-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:09.978093696Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21190-1","title":"Security update for openbabel","description":"This update for openbabel fixes the following issues:\n\nChanges in openbabel:\n\n- Update to version 3.2.0:\n  * Add an L-BFGS optimizer, used by default for gen3d and\n    conformer searches\n  * New macrocycle ring builder (Dale codes) for better initial\n    3D geometry of large rings\n  * Add KET (Ketcher JSON) and ChemicalJSON (.cjson) format\n    support\n  * Drop Python 2 support; Python 3.13 supported\n  * Faster, vectorized distance-geometry implementation\n  * Full CMake 4 compatibility and modernized build\n  * Backwards compatible with 3.0 and 3.1\n  * Fix many crash and memory-safety bugs found via OSS-Fuzz\n    and TALOS, including the following security issues:\n    CVE-2022-37331 (boo#1217676), CVE-2022-41793, CVE-2022-42885,\n    CVE-2022-43467, CVE-2022-43607, CVE-2022-44451,\n    CVE-2022-46280, CVE-2022-46289, CVE-2022-46290,\n    CVE-2022-46291, CVE-2022-46292, CVE-2022-46294,\n    CVE-2022-46295, CVE-2025-10994, CVE-2025-10995,\n    CVE-2025-10996, CVE-2025-10997, CVE-2025-10998,\n    CVE-2025-10999, CVE-2025-11000,\n    CVE-2026-2704 (boo#1258501), CVE-2026-2705 (boo#1258507) and\n    CVE-2026-3408 (boo#1259041)\n","status":"published","published":"2026-07-01T09:21:23Z","modified":"2026-07-03T18:24:23.69365859Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}