Log in Start free

Vulnerability · Published Jul 21, 2023 · Assigned by talos

CVE-2022-46293

Critical 9.8

In plain English

A critical-severity memory corruption in Open Babel from Open Babel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 41.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability affects the MOPAC file format, inside the Final Point and Derivatives section

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openbabelno fix listedDEBIAN-CVE-2022-46293
Debian:13openbabelno fix listedDEBIAN-CVE-2022-46293
Debian:14openbabelno fix listedDEBIAN-CVE-2022-46293
PyPIopenbabel3.2.0GHSA-7h6r-6p76-68c9
PyPIopenbabel3.2.0PYSEC-2026-2775
Ubuntu:22.04:LTSopenbabelno fix listedUBUNTU-CVE-2022-46293
Ubuntu:24.04:LTSopenbabelno fix listedUBUNTU-CVE-2022-46293
Ubuntu:25.10openbabelno fix listedUBUNTU-CVE-2022-46293
Ubuntu:26.04:LTSopenbabelno fix listedUBUNTU-CVE-2022-46293
Ubuntu:26.10openbabelno fix listedUBUNTU-CVE-2022-46293

Affected products (as reported)

VendorProductVersions
Open Babel Open Babel 3.1.1master commit 530dbfa3

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References