high · 7.8CVE-2025-10996Jun 30, 2026

CVE-2025-10996: Open Babel SMILES Parser Heap Buffer Overflow

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Open Babel's SMILES parser reads past the end of a heap buffer when given a crafted molecule string, which can crash or corrupt memory in any application that converts chemistry file formats.

Packageopenbabel
Ecosystempip
Affected< 3.2.0
Fixed in3.2.0

The problem

The function `OBSmilesParser::ParseSmiles` in `src/formats/smilesformat.cpp` performs an out-of-bounds read of 4 bytes on a heap-allocated vector when processing a malformed SMILES string.

Open Babel is embedded in Linux distributions, Python/Ruby/Java/R/Perl/C#/PHP bindings, and web-facing cheminformatics pipelines. Any code path that calls `OBConversion` or `obabel` on untrusted SMILES is affected, making this reachable from scripts, REST APIs, and CI pipelines alike.

The fix

Upgrade to Open Babel 3.2.0 (released 2026-05-26). The patch is commit b34cd604, consolidated in PR #2913. If you cannot upgrade immediately, avoid passing untrusted SMILES strings to `obabel`, `OBConversion::ReadString`, or any language binding that calls `SmiToMol` until the patch is applied.

Reported by OSS-Fuzz.

References: [1][2][3][4][5][6]

Related research