CVE-2025-10996
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the OBSmilesParser::ParseSmiles function in /src/formats/smilesformat.cpp. The attack requires local access.
Risk Assessment
A local attacker can exploit this vulnerability to execute code or cause a denial of service, potentially compromising confidentiality, integrity, and availability.
Recommendation
Update Open Babel to a patched version or avoid processing untrusted SMILES files.
Other vulnerabilities in Open Babel
See all- CVE-2025-11000Low
In Open Babel up to version 3.1.1, the PQSFormat::ReadMolecule function in /src/formats/PQSformat.cpp causes a null pointer dereference. The attack requires local access, and the exploit has been publicly disclosed.
- CVE-2025-10999Low
In Open Babel up to version 3.1.1, the CacaoFormat::SetHilderbrandt function in /src/formats/cacaoformat.cpp causes a null pointer dereference. The attack is only possible with local access, and the exploit has been made public.
- CVE-2025-10998Low
In Open Babel up to 3.1.1, the ChemKinFormat::ReadReactionQualifierLines function in /src/formats/chemkinformat.cpp causes a null pointer dereference. The attack can only be performed locally. The exploit has been disclosed publicly and may be used.
- CVE-2025-10997Medium
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the ChemKinFormat::CheckSpecies function in /src/formats/chemkinformat.cpp. The attack can only be executed locally.
- CVE-2025-10995Medium
A vulnerability was detected in Open Babel up to version 3.1.1 in the function zlib_stream::basic_unzip_streambuf::underflow in /src/zipstreamimpl.h. Manipulation leads to memory corruption. Local access is required, and the exploit has been publicly disclosed and may be used.
- CVE-2025-10994Medium
Open Babel through version 3.1.1 contains a use-after-free vulnerability in the GAMESSOutputFormat::ReadMolecule function in gamessformat.cpp. The attack can be launched locally and the exploit has been made publicly available.
Original NVD description (English source)
A vulnerability was detected in Open Babel up to 3.1.1. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS