Open Babel gamessformat.cpp ReadMolecule use after free
Priority MEDIUM 55CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
A weakness has been identified in Open Babel up to 3.1.1. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed openbabel (PyPI): 3.2.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Open Babel | 3.1.0; 3.1.1 | — | No fix listed | CNA |
| — | openbabel (PyPI) | before 3.2.0 | 3.2.0 | Patch available | GHSA-pp85-5j63-xpq3 |
- Open Babel Vendor— Affected 3.1.0; 3.1.1 Fixed in — No fix listed CNA
- openbabel (PyPI) Vendor— Affected before 3.2.0 Fixed in 3.2.0 Patch available GHSA-pp85-5j63-xpq3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openbabel:open_babel:*:*:*:*:*:*:*:* | up to 3.1.1 | Vulnerable | Open Babel |
- cpe:2.3:a:openbabel:open_babel:*:*:*:*:*:*:*:* Versions up to 3.1.1 Vulnerable ·Open Babel
Remediation
- Fix · GHSA-pp85-5j63-xpq3 openbabel (PyPI) Fixed in 3.2.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-10994
- 2026-10-03 Alias added: GHSA-pp85-5j63-xpq3
References
Exploit 2
More Open Babel vulnerabilities
- TI-2022-22844 Memory corruption in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22843 Memory corruption in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22840 Memory corruption in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22839 Heap-based buffer overflow in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22838 Heap-based buffer overflow in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-21850 A use of uninitialized pointer vulnerability exists in the MSI format atom functionality… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-10994 · CVE Program
- CVE-2025-10994 · NVD
- FIRST EPSS
- GHSA-pp85-5j63-xpq3 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-10994 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences