Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereference
Priority MEDIUM 55CWE-404Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-404.
Summary
A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been made public and could be used.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00252 16th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed openbabel (PyPI): 3.2.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Open Babel | 3.1.0; 3.1.1 | — | No fix listed | CNA |
| — | openbabel (PyPI) | before 3.2.0 | 3.2.0 | Patch available | GHSA-55j6-rjhx-hwfh |
- Open Babel Vendor— Affected 3.1.0; 3.1.1 Fixed in — No fix listed CNA
- openbabel (PyPI) Vendor— Affected before 3.2.0 Fixed in 3.2.0 Patch available GHSA-55j6-rjhx-hwfh
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openbabel:open_babel:*:*:*:*:*:*:*:* | up to 3.1.1 | Vulnerable | Open Babel |
- cpe:2.3:a:openbabel:open_babel:*:*:*:*:*:*:*:* Versions up to 3.1.1 Vulnerable ·Open Babel
Remediation
- Fix · GHSA-55j6-rjhx-hwfh openbabel (PyPI) Fixed in 3.2.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-10999
- 2026-10-03 Alias added: GHSA-55j6-rjhx-hwfh
References
Exploit 2
More Open Babel vulnerabilities
- TI-2022-22844 Memory corruption in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22843 Memory corruption in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22840 Memory corruption in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22839 Heap-based buffer overflow in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-22838 Heap-based buffer overflow in Open Babel CVSS 3.1CRITICAL 9.8
- TI-2022-21850 A use of uninitialized pointer vulnerability exists in the MSI format atom functionality… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-10999 · CVE Program
- CVE-2025-10999 · NVD
- FIRST EPSS
- GHSA-55j6-rjhx-hwfh · GitHub Advisory Database · CC BY 4.0
- CVE-2025-10999 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences