CVE-2025-10996
📋 TL;DR
This vulnerability allows local attackers to execute arbitrary code or cause denial of service through a heap-based buffer overflow in Open Babel's SMILES parser. It affects users of Open Babel up to version 3.1.1 who process untrusted SMILES chemical notation files. The attack requires local access to the system.
💻 Affected Systems
- Open Babel
📦 What is this software?
Open Babel by Openbabel
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, data theft, or persistent backdoor installation.
Likely Case
Application crash (denial of service) or limited code execution within the Open Babel process context.
If Mitigated
Minimal impact if proper sandboxing, privilege separation, and input validation are implemented.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available in the provided GitHub attachments. Exploitation requires local access and ability to feed malicious SMILES input to the parser.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Open Babel version after 3.1.1 (check latest release)
Vendor Advisory: https://github.com/openbabel/openbabel/issues/2831
Restart Required: No
Instructions:
1. Check current Open Babel version. 2. Update to latest version from official repository. 3. Recompile any applications using Open Babel libraries. 4. Test with known safe SMILES files.
🔧 Temporary Workarounds
Input Validation/Sanitization
allImplement strict input validation for SMILES files before passing to Open Babel parser
Sandbox Execution
Linux/UnixRun Open Babel in restricted environment using containerization or sandboxing
docker run --read-only --cap-drop=ALL openbabel
firejail --private openbabel
🧯 If You Can't Patch
- Restrict local access to systems running Open Babel to trusted users only.
- Implement application whitelisting to prevent execution of unauthorized binaries alongside Open Babel.
🔍 How to Verify
Check if Vulnerable:
Check Open Babel version: 'obabel --version' or examine package manager output. If version is 3.1.1 or earlier, system is vulnerable.Check Version:
obabel --versionVerify Fix Applied:
After updating, verify version is greater than 3.1.1 and test parsing known safe SMILES files without crashes.📡 Detection & Monitoring
Log Indicators:
- Open Babel process crashes with segmentation fault or heap corruption errors
- Abnormal termination of applications using Open Babel libraries
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
Process:Name='obabel' AND EventID=1000 (Application Crash) OR Process:Name contains 'openbabel' AND EventID=1000