CVE catalog

CVE-2026-3408

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Mar 2, 2026, 3:32:10 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.51% · Oct 25, 2026

A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openbabel	sid	`3.2.0+dfsg-2`	vulnerable
Debian	openbabel	forky	`3.2.0+dfsg-1`	vulnerable
Debian	openbabel	trixie	`3.1.1+dfsg-12`	vulnerable
Debian	openbabel	bookworm	`3.1.1+dfsg-9`	vulnerable
Cpe	openbabel	Not reported	Not reported	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openbabel	source	sid	`(unfixed)`	not yet assigned	Not reported	[1129566]
Debian	openbabel	source	forky	`(unfixed)`	not yet assigned	Not reported	[1129566]
Debian	openbabel	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1129566]
Debian	openbabel	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1129566]

[Debian bug #1129566]

Notes

[trixie] openbabel: Minor issue [bookworm] openbabel: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libchemistry-openbabel-perl]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-9+b3 · amd64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
- 3.1.1+dfsg-9+b3 · arm64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
[libopenbabel7]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-9+b3 · amd64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
- 3.1.1+dfsg-9+b3 · arm64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
[libopenbabel-dev]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-9+b3 · amd64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
- 3.1.1+dfsg-9+b3 · arm64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
[libopenbabel-doc]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-9 · all · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
- 3.1.1+dfsg-9 · all · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
[openbabel]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-9+b3 · amd64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
- 3.1.1+dfsg-9+b3 · arm64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
[openbabel-gui]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-9+b3 · amd64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
- 3.1.1+dfsg-9+b3 · arm64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
[python3-openbabel]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-9+b3 · amd64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12
- 3.1.1+dfsg-9+b3 · arm64 · bookworm
  Affected
  nvd · openbabel · debian · bookworm; nvd · openbabel · debian · 12

[Debian 13 (Trixie)]

[libchemistry-openbabel-perl]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-12 · amd64 · trixie
  Affected
  nvd · openbabel · debian · 13
- 3.1.1+dfsg-12 · arm64 · trixie
  Affected
  nvd · openbabel · debian · 13
[libopenbabel7]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-12 · amd64 · trixie
  Affected
  nvd · openbabel · debian · 13
- 3.1.1+dfsg-12 · arm64 · trixie
  Affected
  nvd · openbabel · debian · 13
[libopenbabel-dev]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-12 · amd64 · trixie
  Affected
  nvd · openbabel · debian · 13
- 3.1.1+dfsg-12 · arm64 · trixie
  Affected
  nvd · openbabel · debian · 13
[libopenbabel-doc]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-12 · all · trixie
  Affected
  nvd · openbabel · debian · 13
- 3.1.1+dfsg-12 · all · trixie
  Affected
  nvd · openbabel · debian · 13
[openbabel]Affected
Details (2)
- 3.1.1+dfsg-12 · amd64 · trixie
  Affected
  nvd · openbabel · debian · 13
- 3.1.1+dfsg-12 · arm64 · trixie
  Affected
  nvd · openbabel · debian · 13
[openbabel-gui]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-12 · amd64 · trixie
  Affected
  nvd · openbabel · debian · 13
- 3.1.1+dfsg-12 · arm64 · trixie
  Affected
  nvd · openbabel · debian · 13
[python3-openbabel]Affected
Source package: [openbabel]
Details (2)
- 3.1.1+dfsg-12 · amd64 · trixie
  Affected
  nvd · openbabel · debian · 13
- 3.1.1+dfsg-12 · arm64 · trixie
  Affected
  nvd · openbabel · debian · 13

Observed: Oct 24, 2026, 12:38:14 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]