Log in Start free

Vulnerability · Published Feb 19, 2026 · Assigned by VulDB

CVE-2026-2704Open Babel CIF File transform3d.cpp DescribeAsString out-of-bounds

Medium 4.3

In plain English

A medium-severity out-of-bounds read in Open Babel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.9%top 40.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is sufficient to fix this issue. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openbabelno fix listedDEBIAN-CVE-2026-2704
Debian:13openbabelno fix listedDEBIAN-CVE-2026-2704
Debian:14openbabel3.2.0+dfsg-1DEBIAN-CVE-2026-2704
PyPIopenbabel3.2.0GHSA-6xw4-2g22-26h8
PyPIopenbabel3.2.0PYSEC-2026-2774
Ubuntu:22.04:LTSopenbabelno fix listedUBUNTU-CVE-2026-2704
Ubuntu:24.04:LTSopenbabelno fix listedUBUNTU-CVE-2026-2704
Ubuntu:25.10openbabelno fix listedUBUNTU-CVE-2026-2704
Ubuntu:26.04:LTSopenbabelno fix listedUBUNTU-CVE-2026-2704
Ubuntu:26.10openbabelno fix listedUBUNTU-CVE-2026-2704

Affected products (as reported)

VendorProductVersions
n/a Open Babel 3.1.03.1.1

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References