CVE-2025-10998
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Open Babel up to 3.1.1, the ChemKinFormat::ReadReactionQualifierLines function in /src/formats/chemkinformat.cpp causes a null pointer dereference. The attack can only be performed locally. The exploit has been disclosed publicly and may be used.
Risk Assessment
A local attacker could cause an application crash via a crafted input file. This may lead to denial of service or instability.
Recommendation
Update Open Babel to a version later than 3.1.1 if available, or apply a fix. Avoid processing untrusted ChemKin files.
Other vulnerabilities in Open Babel
See all- CVE-2025-11000Low
In Open Babel up to version 3.1.1, the PQSFormat::ReadMolecule function in /src/formats/PQSformat.cpp causes a null pointer dereference. The attack requires local access, and the exploit has been publicly disclosed.
- CVE-2025-10999Low
In Open Babel up to version 3.1.1, the CacaoFormat::SetHilderbrandt function in /src/formats/cacaoformat.cpp causes a null pointer dereference. The attack is only possible with local access, and the exploit has been made public.
- CVE-2025-10997Medium
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the ChemKinFormat::CheckSpecies function in /src/formats/chemkinformat.cpp. The attack can only be executed locally.
- CVE-2025-10996Medium
Open Babel up to version 3.1.1 has a heap-based buffer overflow in the OBSmilesParser::ParseSmiles function in /src/formats/smilesformat.cpp. The attack requires local access.
- CVE-2025-10995Medium
A vulnerability was detected in Open Babel up to version 3.1.1 in the function zlib_stream::basic_unzip_streambuf::underflow in /src/zipstreamimpl.h. Manipulation leads to memory corruption. Local access is required, and the exploit has been publicly disclosed and may be used.
- CVE-2025-10994Medium
Open Babel through version 3.1.1 contains a use-after-free vulnerability in the GAMESSOutputFormat::ReadMolecule function in gamessformat.cpp. The attack can be launched locally and the exploit has been made publicly available.
Original NVD description (English source)
A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS