CVE-2025-10994
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Open Babel through version 3.1.1 contains a use-after-free vulnerability in the GAMESSOutputFormat::ReadMolecule function in gamessformat.cpp. The attack can be launched locally and the exploit has been made publicly available.
Risk Assessment
A local attacker could exploit the vulnerability to execute arbitrary code or crash the application, potentially compromising data confidentiality and integrity.
Recommendation
Update Open Babel to a patched version or avoid processing untrusted GAMESS files.
Other vulnerabilities in Open Babel
See all- CVE-2025-11000Low
In Open Babel up to version 3.1.1, the PQSFormat::ReadMolecule function in /src/formats/PQSformat.cpp causes a null pointer dereference. The attack requires local access, and the exploit has been publicly disclosed.
- CVE-2025-10999Low
In Open Babel up to version 3.1.1, the CacaoFormat::SetHilderbrandt function in /src/formats/cacaoformat.cpp causes a null pointer dereference. The attack is only possible with local access, and the exploit has been made public.
- CVE-2025-10998Low
In Open Babel up to 3.1.1, the ChemKinFormat::ReadReactionQualifierLines function in /src/formats/chemkinformat.cpp causes a null pointer dereference. The attack can only be performed locally. The exploit has been disclosed publicly and may be used.
- CVE-2025-10997Medium
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the ChemKinFormat::CheckSpecies function in /src/formats/chemkinformat.cpp. The attack can only be executed locally.
- CVE-2025-10996Medium
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the OBSmilesParser::ParseSmiles function in /src/formats/smilesformat.cpp. The attack requires local access.
- CVE-2025-10995Medium
A vulnerability was detected in Open Babel up to version 3.1.1 in the function zlib_stream::basic_unzip_streambuf::underflow in /src/zipstreamimpl.h. Manipulation leads to memory corruption. Local access is required, and the exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS