Security readout for executives and security teams
Plain-English summary
Open Babel can read past memory bounds when processing a specially crafted MOL2 chemistry file. An attacker would need a user or automated workflow to parse the malicious file. Reported impact is limited availability loss, not confirmed code execution or data theft. Public reproduction material exists, so organizations using Open Babel in file-processing pipelines should prioritize patch review.
Executive priority
Treat as a targeted medium-priority issue. It is unlikely to be an enterprise-wide emergency, but public reproduction material raises urgency for organizations processing external chemistry files. Prioritize exposed upload, conversion, and research workflows before internal-only desktop use.
Technical view
CVE-2026-2705 affects Open Babel 3.1.0 and 3.1.1 in OBAtom::SetFormalCharge within include/openbabel/atom.h, reached through the MOL2 file handler. The reported weakness is an out-of-bounds read, mapped to CWE-119 and CWE-125. CVSS 4.0 is 5.3 with network attack vector, low complexity, no privileges, and required user interaction.
Likely exposure
Exposure is most likely in chemistry, research, or conversion services that accept MOL2 files from users, partners, email, uploads, or automated ingestion. Systems not using Open Babel or not parsing MOL2 files are less likely exposed.
Exploitation context
The CVE source states public exploit material is available, and a GitHub reproduction file is referenced. There is no KEV listing and no cited evidence of active exploitation in the provided sources. User interaction is required by the CVSS vector, meaning file parsing must be triggered.
Researcher notes
Evidence points to an out-of-bounds read in MOL2 parsing, with a named patch commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a and PR 2862. The source bundle also says the project had not responded, so official release status is unclear. Avoid assuming impact beyond availability without further vendor confirmation.
Mitigation direction
- Identify Open Babel deployments, especially versions 3.1.0 and 3.1.1.
- Review the referenced patch commit and project pull request.
- Apply vendor or project-approved fixes when available.
- Restrict or isolate processing of untrusted MOL2 files.
- Monitor Open Babel issue and pull request status for official guidance.
Validation and detection
- Inventory packages, containers, and applications embedding Open Babel.
- Confirm whether MOL2 parsing is enabled or reachable by untrusted users.
- Check installed Open Babel version against 3.1.0 and 3.1.1.
- Verify whether the referenced patch commit is present in deployed builds.
- Review logs for crashes during MOL2 file processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-2705 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-346651 | Open Babel MOL2 File atom.h SetFormalCharge out-of-boundsCVE reference · vdb-entry, technical-description
- VDB-346651 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- Submit #754379 | openbabel master-branch NULL Pointer DereferenceCVE reference · third-party-advisory
- https://github.com/openbabel/openbabel/issues/2848CVE reference · issue-tracking
- https://github.com/openbabel/openbabel/pull/2862CVE reference · issue-tracking, patch
- https://github.com/oneafter/0128/blob/main/ob2/repro.mol2CVE reference · exploit
- https://github.com/VedantMadane/openbabel/commit/e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08aCVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.