CVE-2025-10996: Open Babel SMILES Parser Heap Buffer Overflow
Open Babel's SMILES parser reads past the end of a heap buffer when given a crafted molecule string, which can crash or corrupt memory in any application that converts chemistry file formats.
The problem
The function OBSmilesParser::ParseSmiles in src/formats/smilesformat.cpp performs an out-of-bounds read of 4 bytes on a heap-allocated vector when processing a malformed SMILES string.
Open Babel is embedded in Linux distributions, Python/Ruby/Java/R/Perl/C#/PHP bindings, and web-facing cheminformatics pipelines. Any code path that calls OBConversion or obabel on untrusted SMILES is affected, making this reachable from scripts, REST APIs, and CI pipelines alike.
The fix
Upgrade to Open Babel 3.2.0 (released 2026-05-26). The patch is commit b34cd604, consolidated in PR #2913. If you cannot upgrade immediately, avoid passing untrusted SMILES strings to obabel, OBConversion::ReadString, or any language binding that calls SmiToMol until the patch is applied.
Reported by OSS-Fuzz.
Related research
- high · 7.8CVE-2022-46292CVE-2022-46292: Open Babel MOPAC Output Parser Out-of-Bounds Write (UNIT CELL TRANSLATION)
- high · 7.8CVE-2022-43467CVE-2022-43467: Open Babel PQS Parser Out-of-Bounds Write
- high · 7.8CVE-2022-43607CVE-2022-43607: Open Babel MOL2 Parser Stack Buffer Overflow
- high · 7.8CVE-2022-46291CVE-2022-46291: Open Babel Gaussian Parser Stack Buffer Overflow via translationVectors