Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)
Published Jul 21, 2023 · Updated Oct 23, 2026 · Also known as GHSA-55f6-pf8r-c2f4, PYSEC-2026-2771
Original summary
Normalized public record · Updated Oct 23, 2026
Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the translationVectors[] array when reading the "UNIT CELL TRANSLATION" block of a crafted input file.
Potential impact
Open Babel is a C++ library and CLI used to read and write chemistry file formats; it is shipped by Linux distributions and embedded in services that may parse untrusted input. Triggering this vulnerability requires the victim to open a malicious MOPAC output file with the obabel tool, the OBConversion API, or any of the language bindings (Python, Ruby, Java, R, Perl, C, PHP).
Technical context
The MOPAC output reader stored translation vectors from the UNIT CELL TRANSLATION block into a fixed-size translationVectors[] array. A malformed block could push more vectors than the array had slots, causing a write past the end of the array. One of five translationVectors[] OOB writes in the TALOS 2022 batch.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- MEDIUM
- Confidence
- 20%
- Aliases
- GHSA-55f6-pf8r-c2f4, PYSEC-2026-2771
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
Record history
Published Jul 21, 2023 · Last refreshed Oct 23, 2026