VDB
CVE-2026-2704
CVE-2026-2704
PUBLISHED
CVSS 4.300000190734863 MEDIUM
A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
EPSS 0.88% · 59.0th percentile
Risk Scores
CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS Score
0.88%
59.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | Open Babel | 3.1.0, 3.1.1, 3.1.1 |
| openbabel | open_babel | 0 |
Timeline
- Feb 19, 2026 EPSS Score
- Feb 19, 2026 CVE Published
- Feb 22, 2026 EPSS Score
- Feb 24, 2026 EPSS Score
- Feb 27, 2026 EPSS Score
- Mar 2, 2026 EPSS Score
- Mar 4, 2026 EPSS Score
- Mar 7, 2026 EPSS Score
- Mar 10, 2026 EPSS Score
- Mar 13, 2026 EPSS Score
- Mar 15, 2026 EPSS Score
- Mar 18, 2026 EPSS Score
References
- https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a fix
- https://github.com/openbabel/openbabel/issues/2848 discussion
- VDB-346650 | CTI Indicators (IOB, IOC, IOA) url
- https://github.com/oneafter/0128/blob/main/ob1/repro.cif url
- https://vuldb.com/?submit.754378 url
- VDB-346650 | Open Babel CIF File transform3d.cpp DescribeAsString out-of-bounds vdb
- https://nvd.nist.gov/vuln/detail/CVE-2026-2704 advisory
- https://github.com/openbabel/openbabel/pull/2862 fix