CVE-2026-3408
📋 TL;DR
A null pointer dereference vulnerability in Open Babel's CDXML file handler allows remote attackers to cause denial of service by crashing the application when processing malicious CDXML files. This affects Open Babel versions up to 3.1.1. Users who process untrusted CDXML files are at risk.
💻 Affected Systems
- Open Babel
📦 What is this software?
Open Babel by Openbabel
⚠️ Risk & Real-World Impact
Worst Case
Remote denial of service causing application crash and potential data loss if processing occurs during critical operations.
Likely Case
Application crash when processing malicious CDXML files, disrupting workflows that rely on Open Babel.
If Mitigated
Minimal impact with proper input validation and sandboxing of file processing.
🎯 Exploit Status
Proof-of-concept exploit file available in GitHub repository; exploitation requires victim to process malicious CDXML file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a and later
Vendor Advisory: https://github.com/openbabel/openbabel/issues/2848
Restart Required: Yes
Instructions:
1. Update Open Babel to version after 3.1.1 or apply commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. 2. Rebuild from source if using compiled version. 3. Restart any services using Open Babel.
🔧 Temporary Workarounds
Disable CDXML file processing
allRemove or disable CDXML file handler functionality to prevent exploitation
# Recompile Open Babel with CDXML support disabled
# Modify configuration to reject CDXML files
Input validation for CDXML files
allImplement strict validation of CDXML files before processing
# Add file validation checks in application code
# Use file type verification before passing to Open Babel
🧯 If You Can't Patch
- Implement network segmentation to isolate Open Babel instances from untrusted networks
- Use application sandboxing or containerization to limit impact of crashes
🔍 How to Verify
Check if Vulnerable:
Check Open Babel version: openbabel --version. If version is 3.1.1 or earlier, system is vulnerable.Check Version:
openbabel --versionVerify Fix Applied:
Verify commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a is included in your build or version is later than 3.1.1.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Error messages referencing atom.cpp or CDXML processing
Network Indicators:
- Unexpected CDXML file uploads to systems running Open Babel
SIEM Query:
source="application.log" AND ("segmentation fault" OR "null pointer" OR "CDXML")🔗 References
- https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a
- https://github.com/oneafter/0128/blob/main/ob3/repro.cdxml
- https://github.com/openbabel/openbabel/issues/2848
- https://github.com/openbabel/openbabel/pull/2862
- https://vuldb.com/?ctiid.348303
- https://vuldb.com/?id.348303
- https://vuldb.com/?submit.763756
