Buffer overflow in Openbabel Open Babel
CVE-2026-2704
A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is sufficient to fix this issue. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.008 (56.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: +0.001
Affected products
- Openbabel Open Babel
- Open Babel — versions 3.1.1, 3.1.0, 3.2.0
Weakness classification (CWE)
References
- VDB-346650 | Open Babel CIF File transform3d.cpp DescribeAsString out-of-bounds (technical-description, Third Party Advisory, VDB Entry, vdb-entry)
- VDB-346650 | CTI Indicators (IOB, IOC, IOA) (signature, Permissions Required, permissions-required, VDB Entry)
- Submit #754378 | openbabel master-branch Heap-based Buffer Overflow (Third Party Advisory, VDB Entry, third-party-advisory)
- github.com/openbabel/openbabel/issues/2848 (issue-tracking, Exploit, Third Party Advisory)
- github.com/openbabel/openbabel/pull/2862 (issue-tracking, patch)
- github.com/oneafter/0128/blob/main/ob1/repro.cif (Exploit, exploit)
- github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa0… (patch)
- vuldb.com/vuln/346650 (technical-description, vdb-entry)
- vuldb.com/vuln/346650/cti (signature, permissions-required)
- vuldb.com/submit/754378 (third-party-advisory)
Frequently asked questions
- What is CVE-2026-2704?
- CVE-2026-2704 is a medium-severity vulnerability in Openbabel Open Babel, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 4.3/10. Published 2026-02-19.
- How severe is CVE-2026-2704?
- Medium severity. CVSS v3 base score is 4.3 out of 10.