high · 7.8CVE-2025-10996Jun 30, 2026

CVE-2025-10996: Open Babel SMILES Parser Heap Buffer Overflow

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Open Babel's SMILES parser reads past the end of a heap buffer when given a crafted molecule string, which can crash or corrupt memory in any application that converts chemistry file formats.

Packageopenbabel
Ecosystempip
Affected< 3.2.0
Fixed in3.2.0

The problem

The function OBSmilesParser::ParseSmiles in src/formats/smilesformat.cpp performs an out-of-bounds read of 4 bytes on a heap-allocated vector when processing a malformed SMILES string.

Open Babel is embedded in Linux distributions, Python/Ruby/Java/R/Perl/C#/PHP bindings, and web-facing cheminformatics pipelines. Any code path that calls OBConversion or obabel on untrusted SMILES is affected, making this reachable from scripts, REST APIs, and CI pipelines alike.

The fix

Upgrade to Open Babel 3.2.0 (released 2026-05-26). The patch is commit b34cd604, consolidated in PR #2913. If you cannot upgrade immediately, avoid passing untrusted SMILES strings to obabel, OBConversion::ReadString, or any language binding that calls SmiToMol until the patch is applied.

Reported by OSS-Fuzz.

References: [1][2][3][4][5][6]

Related research