CVE-2026-3408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3408", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-01T07:11:14.065Z", "datePublished": "2026-03-02T03:32:10.760Z", "dateUpdated": "2026-03-02T14:39:26.476Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-02T03:32:10.760Z"}, "title": "Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-476", "lang": "en", "description": "NULL Pointer Dereference"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "n/a", "product": "Open Babel", "versions": [{"version": "3.1.0", "status": "affected"}, {"version": "3.1.1", "status": "affected"}], "modules": ["CDXML File Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-01T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-01T08:16:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Oneafter (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.348303", "name": "VDB-348303 | Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.348303", "name": "VDB-348303 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.763756", "name": "Submit #763756 | openbabel Open Babel 3.1.1 and master-branch NULL Pointer Dereference", "tags": ["third-party-advisory"]}, {"url": "https://github.com/openbabel/openbabel/issues/2848", "tags": ["issue-tracking"]}, {"url": "https://github.com/openbabel/openbabel/pull/2862", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/oneafter/0128/blob/main/ob3/repro.cdxml", "tags": ["exploit"]}, {"url": "https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a", "tags": ["patch"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T14:38:51.668745Z", "id": "CVE-2026-3408", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T14:39:26.476Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3408", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T14:38:51.668745Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T14:38:57.107Z"}}], "cna": {"tags": ["x_open-source"], "title": "Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference", "credits": [{"lang": "en", "type": "reporter", "value": "Oneafter (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "n/a", "modules": ["CDXML File Handler"], "product": "Open Babel", "versions": [{"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.1.1"}]}], "timeline": [{"lang": "en", "time": "2026-03-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-01T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-01T08:16:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.348303", "name": "VDB-348303 | Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.348303", "name": "VDB-348303 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.763756", "name": "Submit #763756 | openbabel Open Babel 3.1.1 and master-branch NULL Pointer Dereference", "tags": ["third-party-advisory"]}, {"url": "https://github.com/openbabel/openbabel/issues/2848", "tags": ["issue-tracking"]}, {"url": "https://github.com/openbabel/openbabel/pull/2862", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/oneafter/0128/blob/main/ob3/repro.cdxml", "tags": ["exploit"]}, {"url": "https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "NULL Pointer Dereference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-02T03:32:10.760Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3408", "state": "PUBLISHED", "dateUpdated": "2026-03-02T14:39:26.476Z", "dateReserved": "2026-03-01T07:11:14.065Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-02T03:32:10.760Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["CDXML File Handler"], "product": "Open Babel", "vendor": "n/a", "versions": [{"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.1.1"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openbabel:open_babel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1F53B5D-AE11-4406-B954-7BD33D2E4DE6", "versionEndIncluding": "3.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad en Open Babel hasta 3.1.1, la cual afecta a la funci\u00f3n OBAtom::GetExplicitValence del archivo isrc/atom.cpp del componente Gestor de Archivos CDXML. Si se manipula se provoca una desreferencia de puntero nulo. El ataque puede ser lanzado en remoto. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser usado. El nombre del parche es e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. Se recomienda aplicar un parche para resolver este problema."}], "id": "CVE-2026-3408", "lastModified": "2026-06-17T10:43:33.380", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3408", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T14:38:51.668745Z", "version": "2.0.3"}}]}, "published": "2026-03-02T04:16:06.023", "references": [{"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a"}, {"source": "cna@vuldb.com", "tags": ["Issue Tracking"], "url": "https://github.com/oneafter/0128/blob/main/ob3/repro.cdxml"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/openbabel/openbabel/issues/2848"}, {"source": "cna@vuldb.com", "tags": ["Issue Tracking"], "url": "https://github.com/openbabel/openbabel/pull/2862"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.348303"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.348303"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.763756"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-476"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.1.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Open Babel", "source": "cna", "vendor": "n/a"}, "product": "open_babel", "vendor": "openbabel"}], "analysis": {"en": {"generated_at": "2026-04-17T13:37:05.969335+00:00", "value": {"mitigation_remediation": ["Apply the official patch identified by commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a to update Open\u202fBabel to version 3.1.2 or later", "Upgrade Open\u202fBabel to the latest stable release if available", "Restrict processing of untrusted CDXML files until the patch is applied"], "summary": {"action": "Immediate Patch", "impact": "Remote Null Pointer Dereference (potential DoS)"}, "threat_synthesis": {"affected_systems": "Open\u202fBabel, a cheminformatics toolkit used in chemistry and bio\u2011informatics, is affected in all releases up to and including 3.1.1. The source code affected resides in the CDXML file handler module (atom.cpp).", "description_and_impact": "An issue in Open\u202fBabel versions up to 3.1.1 allows an attacker to trigger a null\u2011pointer dereference inside the CDXML file handler when the function OBAtom::GetExplicitValence is called. This defect can cause the application to crash, leading to a denial of service. The flaw is formally categorized as a null pointer dereference, an out\u2011of\u2011bounds write, and an improper resource release. A successful exploitation would compromise the availability of the affected system.", "risk_and_exploitability": "The risk is moderate with a CVSS score of 5.3 and a very low EPSS probability (<1\u202f%). However the vulnerability has a publicly available exploit and can be triggered remotely via crafted CDXML files, making it a realistic threat to users who load untrusted data. Because the issue arises from a null pointer dereference, any process that invokes OBAtom::GetExplicitValence on a malformed CDXML file could crash. The KEV listing does not record this vulnerability, but the presence of an exploit means that it should be addressed promptly."}}}}, "created": "2026-03-02T12:03:50.158341+00:00", "updated": "2026-04-17T13:45:16.026845+00:00", "vendors": ["openbabel", "openbabel$PRODUCT$open_babel"]}