CVE-2025-10997: Open Babel Buffer Overflow Vulnerability

CVE-2025-10997 Overview

CVE-2025-10997 is a heap-based buffer overflow in Open Babel versions up to 3.1.1. The flaw resides in the ChemKinFormat::CheckSpecies function within /src/formats/chemkinformat.cpp. An attacker with local access and low privileges can trigger the overflow by supplying crafted ChemKin-format input, corrupting heap memory during parsing. A proof-of-concept exploit has been published publicly, though no active exploitation has been reported. The weakness is tracked under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Open Babel is a widely used cheminformatics toolkit for converting chemical file formats, making this bug relevant to research and pharmaceutical computing environments.

Critical Impact
Local attackers can trigger heap corruption in Open Babel via crafted ChemKin input, potentially affecting confidentiality, integrity, and availability of the parsing process.

Affected Products

Open Babel versions up to and including 3.1.1
The ChemKinFormat::CheckSpecies function in /src/formats/chemkinformat.cpp
Applications and pipelines embedding the affected Open Babel library

Discovery Timeline

2025-09-26 - CVE-2025-10997 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10997

Vulnerability Analysis

CVE-2025-10997 affects Open Babel's ChemKin format parser. The ChemKinFormat::CheckSpecies routine processes species declarations from ChemKin input files without adequately validating buffer boundaries. Manipulating the input causes writes past the end of an allocated heap buffer.

Heap corruption of this kind can overwrite adjacent metadata or object data. Depending on allocator behavior and the surrounding heap layout, this may lead to process crashes, information disclosure, or attacker-influenced control flow. The published proof of concept demonstrates reliable triggering of the overflow.

Root Cause

The root cause is improper restriction of memory buffer operations [CWE-119] during ChemKin species parsing. CheckSpecies fails to enforce a length check that matches the size of the heap-allocated destination buffer when handling species identifiers from untrusted input.

Attack Vector

Exploitation requires local access with low privileges. An attacker supplies a malicious ChemKin file to a user or automated pipeline that invokes Open Babel for conversion or analysis. No user interaction beyond opening or processing the file is required. The scope is limited to the process performing the parsing, which typically runs with the invoking user's permissions.

Because exploitation is local and no remote network vector exists, primary risk scenarios include shared research environments, batch conversion services processing user-submitted files, and web applications that pass uploaded chemical files to Open Babel as a backend converter.

No verified exploitation code is available in the referenced sources. Technical details and the proof-of-concept archive are available in the Open Babel GitHub issue #2830 and the published PoC ZIP.

Detection Methods for CVE-2025-10997

Indicators of Compromise

Unexpected crashes or SIGABRT/SIGSEGV signals from obabel, babel, or applications linking libopenbabel while processing .ck, .ckin, or ChemKin-format files
Heap corruption or ASan heap-buffer-overflow reports referencing ChemKinFormat::CheckSpecies in /src/formats/chemkinformat.cpp
ChemKin input files containing overly long or malformed species identifiers submitted through automated conversion pipelines

Detection Strategies

Enable AddressSanitizer or Valgrind on test builds of Open Babel to identify heap overflows during ChemKin parsing in QA environments
Monitor process telemetry for abnormal exits, core dumps, or child-process terminations tied to Open Babel binaries
Inspect audit logs for local users invoking Open Babel with attacker-controlled files from world-writable or upload directories

Monitoring Recommendations

Log all invocations of Open Babel utilities and capture input file paths for forensic review
Alert on repeated crashes of Open Babel processes across a short time window, which may indicate exploit development or brute-force triggering
Track file uploads containing ChemKin extensions and correlate with subsequent Open Babel process activity

How to Mitigate CVE-2025-10997

Immediate Actions Required

Inventory hosts, containers, and pipelines that install or link Open Babel version 3.1.1 or earlier
Restrict Open Babel execution to trusted input sources and disable automated processing of ChemKin files from untrusted users
Run Open Babel under least-privilege service accounts and within sandboxed environments such as containers or seccomp-restricted processes

Patch Information

At the time of publication, no vendor-issued fixed release is referenced in the NVD entry. Track the Open Babel GitHub issue #2830 for upstream remediation status. When a patched release is published, upgrade all instances of libopenbabel and the obabel CLI, then rebuild dependent applications that statically link the library.

Workarounds

Disable or remove the ChemKin format handler from Open Babel builds where the format is not required
Validate ChemKin input files against strict length and structural constraints before passing them to Open Babel
Isolate conversion workloads in ephemeral containers or virtual machines so heap corruption cannot affect persistent host state
Apply mandatory access controls (SELinux, AppArmor) to constrain Open Babel processes to minimum required file and system resources

bash

# Configuration example: run Open Babel in a restricted container
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --user 65534:65534 \
  -v /data/input:/input:ro \
  openbabel/openbabel:latest \
  obabel /input/molecule.ck -o smi