CVE-2026-3408
Null Pointer Dereference in Open Babel CDXML File Handler
Publication date: 2026-03-02
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openbabel | open_babel | to 3.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3408 is a null pointer dereference vulnerability in Open Babel versions up to 3.1.1. It occurs in the function OBAtom::GetExplicitValence within the CDXML File Handler component. When processing malformed CDXML (ChemDraw XML) files, the software fails to check if an atom pointer is NULL before using it, leading to a crash due to dereferencing a NULL pointer.
This vulnerability can be triggered remotely by supplying a specially crafted malformed CDXML file, causing the application to crash or exit unexpectedly.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a denial of service condition. By exploiting the null pointer dereference, an attacker can cause Open Babel to crash, disrupting its availability.
Since the attack can be launched remotely without authentication and requires only user interaction (such as processing a malicious CDXML file), it poses a risk to systems using vulnerable versions of Open Babel.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to process a specially crafted malformed CDXML file using the Open Babel tool, which triggers a null pointer dereference and causes a crash.
A practical detection method involves running the obabel command with a known malformed CDXML file (such as repro.cdxml) that triggers the vulnerability.
Example command to test the vulnerability (assuming you have the repro.cdxml file):
- obabel repro.cdxml -O output.sdf
If the application crashes or produces a segmentation fault during this operation, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the official patch identified by commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a to the Open Babel source code.
Alternatively, upgrade Open Babel to a version later than 3.1.1 where this vulnerability is fixed.
Until the patch or upgrade is applied, avoid processing untrusted or malformed CDXML files to reduce the risk of triggering the vulnerability.