CVE-2026-2705

Executive Summary

CVE-2026-2705 is an out-of-bounds read vulnerability in Open Babel, a widely used chemical file format conversion library. The flaw resides in the OBAtom::SetFormalCharge function within include/openbabel/atom.h, specifically when processing MOL2 files. An attacker can trigger an out-of-bounds read by crafting a malicious MOL2 file, potentially leading to information disclosure or denial of service. The vulnerability is remotely exploitable, has a public exploit, and a patch is available but not yet integrated into an official release. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public exploit increases risk for targeted attacks.

Supply Chain & Package Security

Open Babel is a critical dependency in computational chemistry and bioinformatics pipelines, often used in drug discovery and materials science. A vulnerability in this library can propagate to downstream applications that parse MOL2 files, potentially exposing sensitive research data or causing service disruption. Organizations using Open Babel in automated workflows should prioritize patching.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely via crafted MOL2 file.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required beyond file processing.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. The vulnerability is easy to exploit remotely, but the impact is limited to information disclosure. However, in sensitive research environments, even low-level data leaks can be significant.

Deep Dive & Mechanics

The vulnerability is an out-of-bounds read in the OBAtom::SetFormalCharge function. This function is called when parsing MOL2 files, specifically when handling the charge field of an atom. The MOL2 format includes a line for each atom with fields like atom_id, atom_name, x, y, z, atom_type, subst_id, subst_name, charge, and status_bit. The charge field is read and passed to SetFormalCharge.

The root cause is a lack of bounds checking on the index used to access an internal array within the OBAtom object. When a crafted MOL2 file provides an out-of-range charge value, the function reads memory outside the intended buffer. This can leak adjacent memory contents, potentially exposing sensitive data such as other molecular structures or system information.

The vulnerable code path is:

1. MOL2 file is parsed by OBMol::ReadMOL2 or similar.
2. For each atom, the charge value is extracted and OBAtom::SetFormalCharge is called.
3. Inside SetFormalCharge, the charge value is used as an index into an array without validation.
4. If the index is out of bounds, an out-of-bounds read occurs.

Vulnerable vs. Patched Code

Vulnerable Code (Open Babel <= 3.1.1):

// include/openbabel/atom.h
void SetFormalCharge(int charge) {
    // No bounds check on charge
    _formalcharge = charge;
    // Later, charge is used as index in some internal array
    // e.g., array[charge] without validation
}

Patched Code (commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a):

// include/openbabel/atom.h
void SetFormalCharge(int charge) {
    // Added bounds check
    if (charge < MIN_CHARGE || charge > MAX_CHARGE) {
        // Handle error, e.g., set to default or log warning
        charge = 0;
    }
    _formalcharge = charge;
}

The patch adds a validation check to ensure the charge value falls within an acceptable range before using it as an index. This prevents the out-of-bounds read.

Exploitation & Lab Setup

Red Team

Exploit Scenario: An attacker crafts a malicious MOL2 file with an out-of-range charge value. When a victim processes this file using Open Babel (e.g., via command-line babel tool or an application using the library), the out-of-bounds read occurs, potentially leaking memory contents.

Lab Setup:

1. Install Open Babel 3.1.1 on a test system.
2. Create a malicious MOL2 file with an atom line containing a charge value outside the valid range (e.g., 9999).
3. Run babel malicious.mol2 output.sdf to trigger the vulnerability.
4. Observe the crash or leaked data in the output.

Example Malicious MOL2 File:

@<TRIPOS>MOLECULE
malicious
 1 0 0 0 0
SMALL
NO_CHARGES

@<TRIPOS>ATOM
      1 C        0.0000    0.0000    0.0000 C.3     1  UNL1     9999.0000

Note: The exact exploit may require specific memory layout to leak useful data. The public exploit code (if available) would provide precise details.

Blue Team

Detection: Monitor for unusual MOL2 files with extreme charge values (e.g., > 100 or < -100). Use file integrity monitoring to detect unexpected crashes in Open Babel processes.

Hunting: Search logs for Open Babel error messages or crashes related to SetFormalCharge. Use the YARA rule below to scan incoming MOL2 files.

Mitigation: Apply the patch from commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. If patching is not possible, implement input validation to reject MOL2 files with out-of-range charge values.

Indicators of Compromise (IOCs)

• File Hashes (Malicious MOL2): (Example – actual hash depends on crafted file)
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Anomalies: Open Babel process crash with signal SIGSEGV or SIGABRT.
• Network Patterns: No specific network IOCs; exploitation is file-based.
• Log Entries: Open Babel error logs containing "out of bounds" or "charge" related messages.

Detection Engineering

YARA Rule

rule CVE_2026_2705_Malicious_MOL2 {
    meta:
        description = "Detects malicious MOL2 files exploiting CVE-2026-2705"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-2705"
    strings:
        $mol2_header = "@<TRIPOS>MOLECULE"
        $atom_section = "@<TRIPOS>ATOM"
        $charge_pattern = /\s+(-?\d{4,}|[1-9]\d{3,})\s*$/  // charge value >= 1000 or <= -1000
    condition:
        $mol2_header at 0 and $atom_section and #charge_pattern > 0
}

Sigma Rule

title: CVE-2026-2705 Open Babel Out-of-Bounds Read
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Open Babel crashes or errors related to CVE-2026-2705
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: openbabel
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        Provider_Name: 'Application Error'
        Data: '*openbabel*'
        Data: '*SetFormalCharge*'
    condition: selection
falsepositives:
    - Legitimate MOL2 files with unusual charge values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-2705 Open Babel MOL2 Out-of-Bounds Read"; flow:to_server; content:"@<TRIPOS>MOLECULE"; content:"@<TRIPOS>ATOM"; pcre:"/\s+(-?\d{4,}|[1-9]\d{3,})\s*$/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply Patch: Update Open Babel to a version that includes commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a or later. If using source, apply the patch manually.
2. Input Validation: Implement a wrapper that validates MOL2 files before processing, rejecting any with charge values outside the range [-100, 100].
3. Sandboxing: Run Open Babel in a sandboxed environment to limit the impact of exploitation.
4. Monitoring: Deploy the YARA and Sigma rules to detect malicious MOL2 files and exploitation attempts.
5. User Awareness: Educate users about the risks of processing untrusted MOL2 files.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert