CVE-2026-3408

LOW EPSS 31.3%

Published Mar 2, 20264mo ago · Modified Apr 29, 20262mo ago

2.1 CVSS 4.0

Low

Published Mar 2, 2026 4mo ago

Last Modified Apr 29, 2026 2mo ago

Description

A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.

CVSS Details

Base Score

2.1

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction P

Scope X

Threat Intelligence

EPSS Exploit Probability

31.3% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 3

CWE-404

CWE-476 NULL Pointer Dereference Memory Safety

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

Vendor	Product	Version	Range
openbabel	open_babel	*	≤3.1.1

References 7

github.com https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a

Patch
github.com https://github.com/oneafter/0128/blob/main/ob3/repro.cdxml

Issue Tracking
github.com https://github.com/openbabel/openbabel/issues/2848

ExploitIssue Tracking
github.com https://github.com/openbabel/openbabel/pull/2862

Issue Tracking
vuldb.com https://vuldb.com/?ctiid.348303

Permissions RequiredVDB Entry
vuldb.com https://vuldb.com/?id.348303

Third Party AdvisoryVDB Entry
vuldb.com https://vuldb.com/?submit.763756

Third Party AdvisoryVDB Entry

Remediation

github.com https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a

Patch