CVE-2026-3408
Received Received - Intake
Null Pointer Dereference in Open Babel CDXML File Handler

Publication date: 2026-03-02

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-02
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-03-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-3408
EUVD
EUVD-2026-9141
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
openbabel open_babel to 3.1.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-3408 is a null pointer dereference vulnerability in Open Babel versions up to 3.1.1. It occurs in the function OBAtom::GetExplicitValence within the CDXML File Handler component. When processing malformed CDXML (ChemDraw XML) files, the software fails to check if an atom pointer is NULL before using it, leading to a crash due to dereferencing a NULL pointer.

This vulnerability can be triggered remotely by supplying a specially crafted malformed CDXML file, causing the application to crash or exit unexpectedly.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition. By exploiting the null pointer dereference, an attacker can cause Open Babel to crash, disrupting its availability.

Since the attack can be launched remotely without authentication and requires only user interaction (such as processing a malicious CDXML file), it poses a risk to systems using vulnerable versions of Open Babel.

Compliance Impact

I don't know

Detection Guidance

This vulnerability can be detected by attempting to process a specially crafted malformed CDXML file using the Open Babel tool, which triggers a null pointer dereference and causes a crash.

A practical detection method involves running the obabel command with a known malformed CDXML file (such as repro.cdxml) that triggers the vulnerability.

Example command to test the vulnerability (assuming you have the repro.cdxml file):

  • obabel repro.cdxml -O output.sdf

If the application crashes or produces a segmentation fault during this operation, it indicates the presence of the vulnerability.

Mitigation Strategies

The immediate mitigation step is to apply the official patch identified by commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a to the Open Babel source code.

Alternatively, upgrade Open Babel to a version later than 3.1.1 where this vulnerability is fixed.

Until the patch or upgrade is applied, avoid processing untrusted or malformed CDXML files to reduce the risk of triggering the vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart