CVE-2026-3408

Received Received - Intake

Null Pointer Dereference in Open Babel CDXML File Handler

Publication date: 2026-03-02

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-02

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-03-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-3408

EUVD

EUVD-2026-9141

Affected Vendors & Products

Vendor	Product	Version / Range
openbabel	open_babel	to 3.1.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-3408 is a null pointer dereference vulnerability in Open Babel versions up to 3.1.1. It occurs in the function OBAtom::GetExplicitValence within the CDXML File Handler component. When processing malformed CDXML (ChemDraw XML) files, the software fails to check if an atom pointer is NULL before using it, leading to a crash due to dereferencing a NULL pointer.

This vulnerability can be triggered remotely by supplying a specially crafted malformed CDXML file, causing the application to crash or exit unexpectedly.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition. By exploiting the null pointer dereference, an attacker can cause Open Babel to crash, disrupting its availability.

Since the attack can be launched remotely without authentication and requires only user interaction (such as processing a malicious CDXML file), it poses a risk to systems using vulnerable versions of Open Babel.

Compliance Impact

I don't know

Detection Guidance

This vulnerability can be detected by attempting to process a specially crafted malformed CDXML file using the Open Babel tool, which triggers a null pointer dereference and causes a crash.

A practical detection method involves running the obabel command with a known malformed CDXML file (such as repro.cdxml) that triggers the vulnerability.

Example command to test the vulnerability (assuming you have the repro.cdxml file):

obabel repro.cdxml -O output.sdf

If the application crashes or produces a segmentation fault during this operation, it indicates the presence of the vulnerability.

Mitigation Strategies

The immediate mitigation step is to apply the official patch identified by commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a to the Open Babel source code.

Alternatively, upgrade Open Babel to a version later than 3.1.1 where this vulnerability is fixed.

Until the patch or upgrade is applied, avoid processing untrusted or malformed CDXML files to reduce the risk of triggering the vulnerability.

Hi! I’m here to help you understand CVE-2026-3408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70