PT-2026-22539 · Open Babel · Open Babel

Oneafter · Published 2026-03-02 · Updated 2026-03-02 · CVE-2026-3408

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Babel versions up to 3.1.1

Description A flaw exists in Open Babel up to version 3.1.1 related to a null pointer dereference. This issue is located within the OBAtom::GetExplicitValence function in the isrc/atom.cpp file, specifically within the CDXML File Handler component. The issue can be triggered remotely. The exploit is publicly available.

Recommendations Apply the patch e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a to resolve this issue.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Memory Corruption

Weakness Enumeration

CWE-404

CWE-476

CWE-787

Related Identifiers

CVE-2026-3408

Affected Products

Open Babel

References · 18

• 🔥 https://github.com/openbabel/openbabel/issues/2848 · Exploit
• 🔥 https://github.com/oneafter/0128/blob/main/ob3/repro.cdxml · Exploit
• https://github.com/openbabel/openbabel/pull/2862 · Patch
• https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-3408 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3408 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3408 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3408 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3408 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3408 · Security Note
• https://t.me/CVEtracker/46080 · Telegram Post
• https://twitter.com/CVEnew/status/2028340156156072258 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028340947407221046 · Twitter Post
• https://t.me/cveNotify/153690 · Telegram Post