p PatchFirst

CVE-2026-2704

CVE-2026-2704 · Open Babel CIF File transform3d.cpp DescribeAsString out-of-bounds

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is sufficient to fix this issue. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue.

CVSS 5.3 · Medium · EPSS 0.9% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • open babel

    Versions
    • 3.1.0: Affected
    • 3.1.1: Affected
    • 3.2.0: Not affected

    Update to 3.2.0

  • openbabel Debian:12

    Versions
    • 3.1.1+dfsg-10
    • 3.1.1+dfsg-11
    • 3.1.1+dfsg-12
    • 3.1.1+dfsg-13
    • 3.1.1+dfsg-14
    • 3.1.1+dfsg-15~exp
    • 3.1.1+dfsg-9
    • 3.2.0+dfsg-1
    • 3.2.0+dfsg-1~exp
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Debian:13

    Versions
    • 3.1.1+dfsg-12
    • 3.1.1+dfsg-13
    • 3.1.1+dfsg-14
    • 3.1.1+dfsg-15~exp
    • 3.2.0+dfsg-1
    • 3.2.0+dfsg-1~exp
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Debian:14

    Versions
    • 3.1.1+dfsg-12
    • 3.1.1+dfsg-13
    • 3.1.1+dfsg-14
    • 3.1.1+dfsg-15~exp
    • 3.2.0+dfsg-1
    • 3.2.0+dfsg-1~exp
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel PyPI

    Versions
    • 1.8
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 1.8.4
    • 2.4.0
    • 2.4.1
    • 3.0.0
    • 3.0.0a1
    • 3.1.1
    • 3.1.1.1
    Affected ranges
    • ECOSYSTEM: < 3.2.0

    Update to 3.2.0

  • openbabel Ubuntu:16.04:LTS

    Versions
    • 2.3.2+dfsg-2.2
    • 2.3.2+dfsg-2.2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:18.04:LTS

    Versions
    • 2.3.2+dfsg-3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:20.04:LTS

    Versions
    • 2.4.1+dfsg-3
    • 2.4.1+dfsg-3build1
    • 2.4.1+dfsg-5.1
    • 2.4.1+dfsg-6
    • 3.0.0+dfsg-3
    • 3.0.0+dfsg-3ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:22.04:LTS

    Versions
    • 3.1.1+dfsg-6ubuntu1
    • 3.1.1+dfsg-6ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:24.04:LTS

    Versions
    • 3.1.1+dfsg-9build2
    • 3.1.1+dfsg-9ubuntu1
    • 3.1.1+dfsg-9ubuntu2
    • 3.1.1+dfsg-9ubuntu4
    • 3.1.1+dfsg-9ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:25.10

    Versions
    • 3.1.1+dfsg-11ubuntu3
    • 3.1.1+dfsg-11ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:26.10

    Versions
    • 3.1.1+dfsg-11ubuntu5
    • 3.1.1+dfsg-14ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:26.04:LTS

    Versions
    • 3.1.1+dfsg-11ubuntu4
    • 3.1.1+dfsg-11ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →