Buffer overflow in Openbabel Open Babel
CVE-2026-2704
A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is sufficient to fix this issue. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue.
Vulnerability class: Buffer Overflow
EPSS: 0.008 (51.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
Affected products
- Openbabel Open_babel
- N/a Open Babel — versions 3.1.1, 3.1.0, 3.2.0
Weakness classification (CWE)
References
- VDB-346650 | Open Babel CIF File transform3d.cpp DescribeAsString out-of-bounds (technical-description, Third Party Advisory, VDB Entry, vdb-entry)
- VDB-346650 | CTI Indicators (IOB, IOC, IOA) (signature, Permissions Required, permissions-required, VDB Entry)
- Submit #754378 | openbabel master-branch Heap-based Buffer Overflow (Third Party Advisory, VDB Entry, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Third Party Advisory)
- cna@vuldb.com (issue-tracking, patch)
- cna@vuldb.com (Exploit, exploit)
- cna@vuldb.com (patch)
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-2704?
- CVE-2026-2704 is a medium-severity vulnerability in Openbabel Open Babel, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 4.3/10. Published 2026-02-19.
- How severe is CVE-2026-2704?
- Medium severity. CVSS v3 base score is 4.3 out of 10.