CVE-2025-10995
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was detected in Open Babel up to version 3.1.1 in the function zlib_stream::basic_unzip_streambuf::underflow in /src/zipstreamimpl.h. Manipulation leads to memory corruption. Local access is required, and the exploit has been publicly disclosed and may be used.
Risk Assessment
A local attacker could exploit the vulnerability to cause memory corruption, potentially leading to application crashes or code execution. The risk affects systems where users can run Open Babel with untrusted input.
Recommendation
Update Open Babel to a version later than 3.1.1 if available. Restrict local access to trusted users and avoid processing untrusted files.
Other vulnerabilities in Open Babel
See all- CVE-2025-11000Low
In Open Babel up to version 3.1.1, the PQSFormat::ReadMolecule function in /src/formats/PQSformat.cpp causes a null pointer dereference. The attack requires local access, and the exploit has been publicly disclosed.
- CVE-2025-10999Low
In Open Babel up to version 3.1.1, the CacaoFormat::SetHilderbrandt function in /src/formats/cacaoformat.cpp causes a null pointer dereference. The attack is only possible with local access, and the exploit has been made public.
- CVE-2025-10998Low
In Open Babel up to 3.1.1, the ChemKinFormat::ReadReactionQualifierLines function in /src/formats/chemkinformat.cpp causes a null pointer dereference. The attack can only be performed locally. The exploit has been disclosed publicly and may be used.
- CVE-2025-10997Medium
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the ChemKinFormat::CheckSpecies function in /src/formats/chemkinformat.cpp. The attack can only be executed locally.
- CVE-2025-10996Medium
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the OBSmilesParser::ParseSmiles function in /src/formats/smilesformat.cpp. The attack requires local access.
- CVE-2025-10994Medium
Open Babel through version 3.1.1 contains a use-after-free vulnerability in the GAMESSOutputFormat::ReadMolecule function in gamessformat.cpp. The attack can be launched locally and the exploit has been made publicly available.
Original NVD description (English source)
A security vulnerability has been detected in Open Babel up to 3.1.1. This vulnerability affects the function zlib_stream::basic_unzip_streambuf::underflow in the library /src/zipstreamimpl.h. Such manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS