CVE-2026-3408: 
Python vulnerability analysis and mitigation

CVE-2026-3408 is a NULL pointer dereference vulnerability in Open Babel's CDXML (ChemDraw XML) file handler, affecting versions up to and including 3.1.1. The flaw resides in the OBAtom::GetExplicitValence function within src/atom.cpp, triggered when parsing a malformed CDXML file that causes an atom pointer lookup to return NULL. It was reported on January 28, 2026, published to NVD on March 2, 2026, and patched via commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a merged into the upstream repository on May 9, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in ChemDrawXMLFormat::EndElement (src/formats/xml/cdxmlformat.cpp, line 268). When parsing a malformed CDXML file, _pmol->GetAtom(atoms[*vit]) can return NULL if the atom index referenced in the XML does not correspond to any atom in the molecule. This NULL pointer is then passed directly to OBAtomAssignTypicalImplicitHydrogens(), which calls atom->GetExplicitValence(), dereferencing the NULL pointer and causing a segmentation fault (SEGV). The attack requires user interaction — a victim must open or process a specially crafted CDXML file — but no authentication or special privileges are required. A public proof-of-concept reproducer file (repro.cdxml) is available (GitHub Issue #2848, Patch Commit).

Successful exploitation causes a denial of service (DoS) by crashing the Open Babel application process. There is no impact on confidentiality or integrity — the vulnerability solely affects availability. Any application or pipeline that processes user-supplied CDXML files using Open Babel (e.g., cheminformatics tools, drug discovery platforms, or chemical data converters) is at risk of being crashed by a malicious input file (Red Hat Bugzilla, GitHub Issue #2848).

A public proof-of-concept reproducer (repro.cdxml) is available on GitHub, lowering the barrier to exploitation (GitHub Issue #2848). The EPSS score is approximately 0.04%, indicating a low probability of widespread exploitation in the near term. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated as "Proof of Concept" (Feedly).

1. Craft a malicious CDXML file: Create or obtain a malformed ChemDraw XML (CDXML) file that references atom IDs not present in the molecule structure, causing _pmol->GetAtom() to return NULL. A public reproducer (repro.cdxml) is available at the reporter's GitHub repository.
2. Deliver the file to the target: Distribute the malicious CDXML file to a user or system that processes chemical structure files with Open Babel (e.g., via email attachment, file upload to a web service, or shared network storage).
3. Trigger parsing: Cause Open Babel to parse the file, either by having the victim run obabel -icdxml repro.cdxml -osmi -O /dev/null or by submitting the file to an application that internally invokes Open Babel's CDXML format handler.
4. Crash the application: The CDXML parser's EndElement handler calls OBAtomAssignTypicalImplicitHydrogens() with a NULL atom pointer, which then calls GetExplicitValence() on the NULL pointer, triggering a SEGV and crashing the process (GitHub Issue #2848, Patch Commit).

• Process: Unexpected crash or segmentation fault of the obabel process or any application embedding Open Babel when processing CDXML files; core dump files generated by the Open Babel process.
• Logs: Application logs showing SEGV or AddressSanitizer: SEGV on unknown address 0x000000000040 errors originating from OBAtom::GetExplicitValence or ChemDrawXMLFormat::EndElement; crash reports referencing cdxmlformat.cpp:268.
• File System: Presence of unexpected or externally sourced .cdxml files in directories processed by Open Babel; core dump files (e.g., core.*) in the working directory of the Open Babel process.

Apply the upstream patch commit e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a, which adds a NULL check in cdxmlformat.cpp before passing the atom pointer to OBAtomAssignTypicalImplicitHydrogens(). The fix was merged into the Open Babel master branch on May 9, 2026 (PR #2862); users should build from the patched source or await a versioned release incorporating this fix. As a workaround, restrict or disable the processing of CDXML files from untrusted or external sources, and implement input validation at the application layer before passing files to Open Babel (Patch Commit, GitHub PR #2862, Red Hat Bugzilla).

Red Hat tracked the vulnerability via its Bugzilla system (Bug 2443844) and published a security advisory, classifying it as medium severity. The fix was contributed by community member VedantMadane and merged by the sole Open Babel maintainer (ghutchis), who noted the project's limited maintainer bandwidth. No significant broader media coverage or notable researcher commentary beyond the GitHub issue and patch discussion has been identified (Red Hat Bugzilla, GitHub PR #2862).