CVE-2026-2704: 
Python vulnerability analysis and mitigation

CVE-2026-2704 is a heap-based out-of-bounds read vulnerability in Open Babel's CIF/MMCIF file handler, specifically in the OpenBabel::transform3d::DescribeAsString function within src/math/transform3d.cpp. It affects Open Babel versions up to and including 3.1.1. The vulnerability was reported on January 28, 2026 via a GitHub issue and publicly disclosed on February 19, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the DescribeAsString() function's while loop, which scans for the first non-zero element in a transformation matrix row without an upper bound on the column index j. When a malformed CIF file produces a transformation matrix with an all-zero row, j increments past index 2 and reads 8 bytes beyond the end of the 96-byte (12-double) heap-allocated transform3d buffer. The attack is initiated remotely by delivering a crafted CIF file that the victim opens with a vulnerable Open Babel application; the call chain runs through CIFFormat::ReadMolecule → mmCIFFormat::ReadMolecule → SpaceGroup::AddTransform → DescribeAsString. A public proof-of-concept CIF file and a detailed ASAN crash report are available (GitHub Issue #2848, PoC CIF File, Patch Commit).

Successful exploitation can cause the Open Babel application to crash (denial of service) or leak heap memory contents, potentially exposing sensitive in-memory data. The confidentiality impact is rated High and the availability impact is High under CVSS v3.1, while integrity is unaffected. Because exploitation requires a user to open or process a malicious CIF file, the practical attack surface is limited to workflows that ingest untrusted crystallographic data files, such as cheminformatics pipelines, research tools, or web services that accept user-uploaded molecular structure files (Red Hat Bugzilla, GitHub Issue #2848).

A public proof-of-concept exploit (a crafted repro.cif file) is available on GitHub, and the CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.138%, reflecting low but non-negligible automated exploitation probability. No threat actor attribution has been reported (PoC CIF File, Red Hat Advisory).

1. Craft a malicious CIF file: Create or use the publicly available repro.cif proof-of-concept file that contains a Space Group definition with a transformation matrix row consisting entirely of zeros, which triggers the unbounded while loop in DescribeAsString().
2. Deliver the file to the target: Send the malicious CIF file to a user or upload it to a service that processes CIF/MMCIF files using a vulnerable version of Open Babel (≤ 3.1.1). Social engineering, email attachment, or a malicious file upload endpoint are viable delivery vectors.
3. Trigger file parsing: The victim (or automated pipeline) runs a command such as obabel -icif repro.cif -osmi -O output.smi, causing Open Babel to parse the CIF file and invoke the vulnerable code path: CIFFormat::ReadMolecule → SpaceGroup::AddTransform → DescribeAsString.
4. Out-of-bounds read occurs: The missing j < 3 bounds check causes the loop to read 8 bytes past the end of the 96-byte heap buffer, resulting in either a crash (denial of service) or disclosure of adjacent heap memory contents.
5. Achieve objective: Depending on heap layout and memory contents, the attacker may obtain sensitive data from memory or reliably crash the application/service processing the file (GitHub Issue #2848, PoC CIF File).

• File System: Presence of unexpected or externally sourced .cif or .mmcif files in directories processed by Open Babel; files with Space Group transformation entries containing all-zero matrix rows.
• Process: Open Babel processes (obabel) terminating abnormally with segmentation faults or SIGABRT signals; crash dumps referencing transform3d.cpp:60 or OpenBabel::transform3d::DescribeAsString.
• Logs: Application logs showing AddressSanitizer: heap-buffer-overflow errors in transform3d.cpp; core dump files generated by obabel processes; error messages referencing SpaceGroup::AddTransform or SpaceGroups::ParseLine.
• Network: Unexpected inbound file uploads of .cif or .mmcif files to web services backed by Open Babel, particularly from untrusted or anonymous sources (GitHub Issue #2848).

Upgrade Open Babel to version 3.2.0 or apply the fix introduced in commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a, which adds a j < 3 bounds check in the DescribeAsString() while loop and a continue guard for all-zero rows. The fix was merged into the Open Babel master branch on May 9, 2026 (PR #2862). As a temporary workaround if patching is not immediately possible, restrict or disable processing of untrusted CIF/MMCIF files, implement file input validation, and limit exposure of Open Babel-backed services to trusted users only (Red Hat Bugzilla, Patch Commit, GitHub PR #2862).

Red Hat tracked the issue via Bugzilla (Bug 2440884) and published a security advisory. The Open Babel maintainer (ghutchis) acknowledged the fix and merged the PR on May 9, 2026, noting the project is currently maintained by a single person. The vulnerability was noted by RedPacketSecurity on Mastodon and picked up by automated vulnerability tracking services including VulDB, Tenable Nessus (plugin 299600), and oss-sec. No major media coverage or significant community controversy has been observed (Red Hat Bugzilla, GitHub PR #2862).