Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openbabel | pip | < 3.2.0 | 3.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a heap-based buffer overflow in the ChemKin format parser of Open Babel. The analysis of the provided patch commit af4a4212 and the associated GitHub issue #2830 reveals the root cause. The function OpenBabel::ChemKinFormat::ReadReactionQualifierLines is responsible for parsing qualifier lines in a ChemKin file. It tokenizes each line and processes it based on keywords. For the keyword "TS" (Transition State), the original code did not validate if a second token (the species name) was actually present on the line. If an input file contained a line with just "TS", the code would attempt to access the non-existent second token. This out-of-bounds access resulted in passing a corrupted string to the OpenBabel::ChemKinFormat::CheckSpecies function. The CheckSpecies function then used this corrupted string as a key to search in a std::map, which triggered a heap-buffer-overflow, causing the application to crash. The patch rectifies this by adding a check (toks.size() >= 2) in ReadReactionQualifierLines to ensure the required token is present before processing, thus preventing the out-of-bounds read.
