p PatchFirst

CVE-2026-3408

CVE-2026-3408 · Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.

CVSS 5.3 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • open babel

    Versions
    • 3.1.0: Affected
    • 3.1.1: Affected

    No fix published

  • openbabel Debian:12

    Versions
    • 3.1.1+dfsg-10
    • 3.1.1+dfsg-11
    • 3.1.1+dfsg-12
    • 3.1.1+dfsg-13
    • 3.1.1+dfsg-14
    • 3.1.1+dfsg-15~exp
    • 3.1.1+dfsg-9
    • 3.2.0+dfsg-1
    • 3.2.0+dfsg-1~exp
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Debian:13

    Versions
    • 3.1.1+dfsg-12
    • 3.1.1+dfsg-13
    • 3.1.1+dfsg-14
    • 3.1.1+dfsg-15~exp
    • 3.2.0+dfsg-1
    • 3.2.0+dfsg-1~exp
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Debian:14

    Versions
    • 3.1.1+dfsg-12
    • 3.1.1+dfsg-13
    • 3.1.1+dfsg-14
    • 3.1.1+dfsg-15~exp
    • 3.2.0+dfsg-1
    • 3.2.0+dfsg-1~exp
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel PyPI

    Versions
    • 1.8
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 1.8.4
    • 2.4.0
    • 2.4.1
    • 3.0.0
    • 3.0.0a1
    • 3.1.1
    • 3.1.1.1
    Affected ranges
    • ECOSYSTEM: < 3.2.0

    Update to 3.2.0

  • openbabel Ubuntu:16.04:LTS

    Versions
    • 2.3.2+dfsg-2.2
    • 2.3.2+dfsg-2.2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:18.04:LTS

    Versions
    • 2.3.2+dfsg-3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:20.04:LTS

    Versions
    • 2.4.1+dfsg-3
    • 2.4.1+dfsg-3build1
    • 2.4.1+dfsg-5.1
    • 2.4.1+dfsg-6
    • 3.0.0+dfsg-3
    • 3.0.0+dfsg-3ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:22.04:LTS

    Versions
    • 3.1.1+dfsg-6ubuntu1
    • 3.1.1+dfsg-6ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:24.04:LTS

    Versions
    • 3.1.1+dfsg-9build2
    • 3.1.1+dfsg-9ubuntu1
    • 3.1.1+dfsg-9ubuntu2
    • 3.1.1+dfsg-9ubuntu4
    • 3.1.1+dfsg-9ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:25.10

    Versions
    • 3.1.1+dfsg-11ubuntu3
    • 3.1.1+dfsg-11ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:26.10

    Versions
    • 3.1.1+dfsg-11ubuntu5
    • 3.1.1+dfsg-14ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openbabel Ubuntu:26.04:LTS

    Versions
    • 3.1.1+dfsg-11ubuntu4
    • 3.1.1+dfsg-11ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →