CVE-2026-3408

Executive Summary

CVE-2026-3408 is a null pointer dereference vulnerability in Open Babel, a chemical file format conversion tool. The flaw resides in the OBAtom::GetExplicitValence function within src/atom.cpp, triggered when processing a specially crafted CDXML file. An attacker can remotely exploit this vulnerability to cause a denial of service (application crash) by sending a malicious CDXML file. The vulnerability affects Open Babel up to version 3.1.1. A patch is available in the official repository. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the exploit is publicly available.

Supply Chain & Package Security

Open Babel is a widely used library in computational chemistry and bioinformatics, often integrated into larger scientific workflows and pipelines. A null pointer dereference in the CDXML parser can disrupt automated processing pipelines, leading to service unavailability. Organizations using Open Babel in production environments should prioritize patching to maintain operational integrity.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low

The vulnerability is remotely exploitable without authentication, but only results in a denial of service (application crash). The low availability impact and lack of data breach potential keep the severity at Medium.

Deep Dive & Mechanics

The vulnerability is a classic null pointer dereference in the OBAtom::GetExplicitValence method. When Open Babel parses a CDXML file, it constructs atom objects. If the CDXML file contains malformed or missing data for an atom's explicit valence, the function attempts to dereference a null pointer, leading to a segmentation fault and application crash.

The vulnerable code path is in src/atom.cpp:

unsigned int OBAtom::GetExplicitValence() const
{
    // ... some code ...
    if (_parent) {
        // ... dereference _parent without null check in certain paths
    }
    // ...
}

The patch (commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a) adds a null pointer check before dereferencing _parent, preventing the crash.

Vulnerable vs. Patched Code

Vulnerable Code (before patch):

unsigned int OBAtom::GetExplicitValence() const
{
    unsigned int count = 0;
    if (_parent) {
        // ... some logic ...
        // Missing null check for _parent in a specific code path
        count = _parent->GetExplicitValence(); // Potential null dereference
    }
    return count;
}

Patched Code (after commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a):

unsigned int OBAtom::GetExplicitValence() const
{
    unsigned int count = 0;
    if (_parent) {
        // ... some logic ...
        // Added null check
        if (_parent) {
            count = _parent->GetExplicitValence();
        }
    }
    return count;
}

The patch adds an additional null check before the recursive call, ensuring that _parent is not null before dereferencing.

Exploitation & Lab Setup

Red Team

An attacker can craft a malicious CDXML file that triggers the null pointer dereference. The exploit is publicly available and can be used to crash any Open Babel instance that processes the file.

Example malicious CDXML snippet (conceptual):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE CDXML SYSTEM "http://www.cambridgesoft.com/xml/cdxml.dtd">
<CDXML>
  <page>
    <fragment>
      <node id="1" element="C" explicitValence=""/>
    </fragment>
  </page>
</CDXML>

Exploitation command:

babel malicious.cdxml -O output.sdf

This will cause Open Babel to crash with a segmentation fault.

Blue Team

To detect exploitation attempts, monitor for crashes in Open Babel processes and inspect CDXML files for malformed explicitValence attributes. Use the detection rules below.

Indicators of Compromise (IOCs)

• File Hashes (malicious CDXML): (Example only, actual hash depends on payload)
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
• Process Behavior: Open Babel process crashes with SIGSEGV when processing CDXML files.
• Network: No specific network IOCs; attack is file-based.
• Logs: Application logs showing segmentation fault or null pointer dereference errors.

Detection Engineering

YARA Rule

rule CVE_2026_3408_OpenBabel_CDXML_NullPtr
{
    meta:
        description = "Detects malicious CDXML files targeting CVE-2026-3408"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-3408"
    strings:
        $cdxml_header = "<CDXML"
        $vuln_attr = "explicitValence=\"\""
    condition:
        $cdxml_header and $vuln_attr
}

Sigma Rule

title: Open Babel CDXML Null Pointer Dereference Exploit
id: cve-2026-3408
status: experimental
description: Detects attempts to exploit CVE-2026-3408 via malformed CDXML files
author: Valters IT
date: 2026/01/01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/babel'
        CommandLine|contains: '.cdxml'
    condition: selection
falsepositives:
    - Legitimate CDXML file processing
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-3408 Open Babel CDXML Null Pointer Dereference"; flow:to_server; content:"<CDXML"; nocase; content:"explicitValence=\"\""; nocase; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the patch: Update Open Babel to a version that includes commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a or later.
2. Input validation: Sanitize CDXML files before processing, rejecting files with empty explicitValence attributes.
3. Sandboxing: Run Open Babel in a sandboxed environment to limit the impact of crashes.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.

Valters IT