PT-2026-22539 · Open Babel · Open Babel

Oneafter · Publicado 2026-03-02 · Atualizado 2026-03-02 · CVE-2026-3408

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Babel versions up to 3.1.1

Description A flaw exists in Open Babel up to version 3.1.1 related to a null pointer dereference. This issue is located within the OBAtom::GetExplicitValence function in the isrc/atom.cpp file, specifically within the CDXML File Handler component. The issue can be triggered remotely. The exploit is publicly available.

Recommendations Apply the patch e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a to resolve this issue.

Exploit

Correção

Improper Resource Release

NULL Pointer Dereference

Memory Corruption

Enumeração de Fraquezas

CWE-404

CWE-476

CWE-787

Identificadores relacionados

CVE-2026-3408

Produtos afetados

Open Babel

Referências · 18

• 🔥 https://github.com/openbabel/openbabel/issues/2848 · Exploit
• 🔥 https://github.com/oneafter/0128/blob/main/ob3/repro.cdxml · Exploit
• https://github.com/openbabel/openbabel/pull/2862 · Correção
• https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a · Correção
• https://t.me/CVEtracker/46080 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2026-3408 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2028340156156072258 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3408 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-3408 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2028340947407221046 · Publicação no Twitter
• https://t.me/cveNotify/153690 · Publicação no Telegram
• https://vuldb.com/?id.348303 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3408 · Nota de Segurança
• https://vuldb.com/?submit.763756 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3408 · Aviso do Fabricante