Log in Start free

Vulnerability · Published Mar 2, 2026 · Assigned by VulDB

CVE-2026-3408Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference

Medium 4.3

In plain English

A medium-severity null pointer dereference in Open Babel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.6%top 53.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openbabelno fix listedDEBIAN-CVE-2026-3408
Debian:13openbabelno fix listedDEBIAN-CVE-2026-3408
Debian:14openbabel3.2.0+dfsg-1DEBIAN-CVE-2026-3408
PyPIopenbabel3.2.0GHSA-rxpr-wq63-jr7p
PyPIopenbabel3.2.0PYSEC-2026-2791
Ubuntu:22.04:LTSopenbabelno fix listedUBUNTU-CVE-2026-3408
Ubuntu:24.04:LTSopenbabelno fix listedUBUNTU-CVE-2026-3408
Ubuntu:25.10openbabelno fix listedUBUNTU-CVE-2026-3408
Ubuntu:26.04:LTSopenbabelno fix listedUBUNTU-CVE-2026-3408
Ubuntu:26.10openbabelno fix listedUBUNTU-CVE-2026-3408

Affected products (as reported)

VendorProductVersions
n/a Open Babel 3.1.03.1.1

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References