The vulnerability resides in the Open Babel library up to version 3.1.1, within the function OpenBabel::transform3d::DescribeAsString located in src/math/transform3d.cpp of the CIF File Handler component. A malformed CIF file can trigger an out‑of‑bounds read, allowing an attacker to read arbitrary memory contents. This can lead to disclosure of confidential information, corruption of output, or a crash that may be leveraged for denial‑of‑service. The weakness is a classic buffer overread (CWE‑125) affecting data that is not at the end of the buffer (CWE‑119).

Affected products include Open Babel (pyopenbabel, etc.) for all releases up to and including 3.1.1. The issue is tied to the CIF File Handler component and occurs when parsing CIF files through the DescribeAsString routine. Any deployment of Open Babel 3.1.1 or older that accepts external CIF input is susceptible.

The calculated CVSS v3 score is 5.3, which represents moderate severity. The EPSS score is less than 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. However, the attack vector is remote, leveraging the ability to supply a crafted CIF file to the library; the public exploit has been disclosed, and the download of the malicious file is straightforward. While the potential impact is limited to confidentiality and availability rather than privilege escalation or code execution, the low probability of exploitation reduces overall risk for many environments. Prompt patching mitigates the risk entirely.