Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt
Summary
A memory-safety vulnerability in Open Babel's CACAO parser caused a NULL pointer dereference when reading a crafted input file.
Details
The flaw was in CacaoFormat::SetHilderbrandt. A malformed input
caused the parser to dereference a NULL pointer while applying the
Hilderbrandt transformation.
Impact
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious CACAO file with the obabel
tool, the OBConversion API, or any of the language bindings (Python,
Ruby, Java, R, Perl, C#, PHP).
Affected versions
All releases up to and including 3.1.1.
Patched version
3.2.0 (released 2026-05-26).
Patch
Fix commit: https://github.com/openbabel/openbabel/commit/ecaed96f Originally reported as #2827; fixes consolidated in #2913.
A minimized reproducer for this CVE is checked in under
test/files/fuzz_regress/ and is exercised on every CI build under
ASAN+UBSAN by the fuzzregresstest harness.
Credit
Reported via OSS-Fuzz.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | openbabel | < 3.2.0 | 3.2.0 |
References
- https://github.com/openbabel/openbabel/security/advisories/GHSA-55j6-rjhx-hwfh
- https://nvd.nist.gov/vuln/detail/CVE-2025-10999
- https://github.com/openbabel/openbabel/issues/2827
- https://github.com/openbabel/openbabel/commit/ecaed96f
- https://github.com/openbabel/openbabel
- https://github.com/user-attachments/files/22318503/poc.zip
- https://vuldb.com/?ctiid.325927
- https://vuldb.com/?id.325927
- https://vuldb.com/?submit.654064
- https://pypi.org/project/openbabel
- https://github.com/advisories/GHSA-55j6-rjhx-hwfh
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-404, CWE-476- Platform
- Python (PyPI)
- Package
openbabel- Disclosed
- 01.07.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2772 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-55j6-rjhx-hwfh - CC BY 4.0
Vulnerability history: openbabel
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 24
- First → latest
- 06.2026 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 16
- Medium 2
- Low 6
Disclosures per year
- 2026: 24
-
Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.