PYSEC-2026-2779 Open Babel has out-of-bounds write in PQS coord_file parser

Summary A memory-safety vulnerability in Open Babel's PQS parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordfile parsing path of the PQS reader. A malformed coord file specifier caused the parser to write past the end of its destination...

Open Babel has out-of-bounds write in Gaussian translationVectors[]

SummaryA memory-safety vulnerability in Open Babel's Gaussian output parserallowed an out-of-bounds write into the translationVectors arraywhen reading a crafted input file. DetailsThe Gaussian reader stored periodic-cell translation vectors into afixed-size translationVectors array. A malformed...

PYSEC-2026-2775 Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT)

Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the translationVectors array when reading the "FINAL POINT" block of a crafted input file. Details The MOPAC output reader stored translation vectors from the FINAL POINT block into a...

Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

SummaryA memory-safety vulnerability in Open Babel's SMILES parser caused aheap buffer overflow when reading a crafted input string. DetailsThe flaw was in OBSmilesParser::ParseSmiles. A malformed SMILESinput caused the parser to write past the end of a heap-allocatedbuffer. ImpactOpen Babel is a...

Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

SummaryA memory-safety vulnerability in Open Babel's ChemKin parser causeda NULL pointer dereference when reading a crafted input file. DetailsThe flaw was in ChemKinFormat::ReadReactionQualifierLines. Amalformed reaction qualifier record caused the parser to dereferencea NULL pointer. ImpactOpen...

PYSEC-2026-2770 Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge

Summary A memory-safety vulnerability in Open Babel's MOL2 file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::SetFormalCharge as called from the MOL2 parser. A malformed atom record caused the parser to call the method on a NULL...

Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies

SummaryA memory-safety vulnerability in Open Babel's ChemKin parser causeda heap buffer overflow when reading a crafted input file. DetailsThe flaw was in ChemKinFormat::CheckSpecies. A malformed speciesrecord caused the parser to write past the end of a heap-allocatedbuffer. ImpactOpen Babel is ...

Open Babel has out-of-bounds write in CSR PadString (title field)

SummaryA memory-safety vulnerability in Open Babel's CSR parser allowed anout-of-bounds write when reading a crafted input file. DetailsThe flaw was in the PadString helper used to handle the CSR titlefield. A title longer than the fixed destination buffer caused theparser to write past the end o...

Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

SummaryA memory-safety vulnerability in Open Babel's CACAO parser caused aNULL pointer dereference when reading a crafted input file. DetailsThe flaw was in CacaoFormat::SetHilderbrandt. A malformed inputcaused the parser to dereference a NULL pointer while applying theHilderbrandt transformation...

Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)

SummaryA memory-safety vulnerability in Open Babel's PQS parser caused anout-of-bounds pre-buffer read when reading a crafted input file. DetailsThe flaw was in the lowerit helper used by the PQS parser. Amalformed input caused the helper to read one or more bytes beforethe start of its input...

Open Babel has out-of-bounds write in Gaussian coords_type orientation parser

SummaryA memory-safety vulnerability in Open Babel's Gaussian output parserallowed an out-of-bounds write when reading a crafted input file. DetailsThe flaw was in the coordstype orientation parser inside theGaussian output reader. A malformed orientation block caused theparser to write past the...

PYSEC-2026-2793 Open Babel has out-of-bounds write in Gaussian coords_type orientation parser

Summary A memory-safety vulnerability in Open Babel's Gaussian output parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordstype orientation parser inside the Gaussian output reader. A malformed orientation block caused the parser to write past...

PYSEC-2026-2782 Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines

Summary A memory-safety vulnerability in Open Babel's ChemKin parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in ChemKinFormat::ReadReactionQualifierLines. A malformed reaction qualifier record caused the parser to dereference a NULL pointer. Impac...

Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge

SummaryA memory-safety vulnerability in Open Babel's MOL2 file format parsercaused a NULL pointer dereference when reading a crafted input file. DetailsThe flaw was in OBAtom::SetFormalCharge as called from the MOL2parser. A malformed atom record caused the parser to call the methodon a NULL atom...

PYSEC-2026-2772 Open Babel has NULL pointer dereference in CACAO CacaoFormat::SetHilderbrandt

Summary A memory-safety vulnerability in Open Babel's CACAO parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in CacaoFormat::SetHilderbrandt. A malformed input caused the parser to dereference a NULL pointer while applying the Hilderbrandt...

PYSEC-2026-2781 Open Babel has heap buffer overflow in SMILES OBSmilesParser::ParseSmiles

Summary A memory-safety vulnerability in Open Babel's SMILES parser caused a heap buffer overflow when reading a crafted input string. Details The flaw was in OBSmilesParser::ParseSmiles. A malformed SMILES input caused the parser to write past the end of a heap-allocated buffer. Impact Open Babe...

PYSEC-2026-2774 Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString

Summary A memory-safety vulnerability in Open Babel's CIF file format parser allowed an out-of-bounds read when reading a crafted input file. Details The flaw was in OpenBabel::transform3d::DescribeAsString. A malformed symmetry-operation string caused the parser to read past the end of its...

PYSEC-2026-3036 python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

Summary When parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the...

python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

Summaryparseoptionsheader parsed Content-Disposition and Content-Type headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax filename=charset'lang'value, name=..., and the filename0/filename1 continuation form is decoded and surfaced...

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

SummaryWhen parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the...