CVE-2025-10996: Open Babel SMILES Parser Heap Buffer Overflow
Open Babel's SMILES parser reads past the end of a heap buffer when given a crafted molecule string, which can crash or corrupt memory in any application that converts chemistry file formats.
The problem
The function `OBSmilesParser::ParseSmiles` in `src/formats/smilesformat.cpp` performs an out-of-bounds read of 4 bytes on a heap-allocated vector when processing a malformed SMILES string.
Open Babel is embedded in Linux distributions, Python/Ruby/Java/R/Perl/C#/PHP bindings, and web-facing cheminformatics pipelines. Any code path that calls `OBConversion` or `obabel` on untrusted SMILES is affected, making this reachable from scripts, REST APIs, and CI pipelines alike.
The fix
Upgrade to Open Babel 3.2.0 (released 2026-05-26). The patch is commit b34cd604, consolidated in PR #2913. If you cannot upgrade immediately, avoid passing untrusted SMILES strings to `obabel`, `OBConversion::ReadString`, or any language binding that calls `SmiToMol` until the patch is applied.
Reported by OSS-Fuzz.
Related research
- high · 7.8CVE-2022-46292CVE-2022-46292: Open Babel MOPAC Output Parser Out-of-Bounds Write (UNIT CELL TRANSLATION)
- high · 7.8CVE-2022-43467CVE-2022-43467: Open Babel PQS Parser Out-of-Bounds Write
- high · 7.8CVE-2022-43607CVE-2022-43607: Open Babel MOL2 Parser Stack Buffer Overflow
- high · 7.8CVE-2022-46291CVE-2022-46291: Open Babel Gaussian Parser Stack Buffer Overflow via translationVectors