The vulnerability exists in the Open Babel library in versions up to 3.1.1. The flaw is located in the function OpenBabel::transform3d::DescribeAsString in src/math/transform3d.cpp within the CIF File Handler component. A malformed CIF file can trigger an out‑of‑bounds read, which allows an attacker to read arbitrary memory contents belonging to the Open Babel process. The disclosure of memory data constitutes a confidentiality breach—the extent of the information exposed depends on the memory contents accessed. ""

Open Babel library versions 3.1.1 and earlier are affected by this out‑of‑bounds read flaw. The vulnerability is present in the CIF File Handler submodule and is fixed in Open Babel version 3.2.0 and later. Users who are using older releases, or who compile from source without applying the available patch, are susceptible.

The CVSS score for this issue is 5.3, indicating a moderate severity. The EPSS score is less than 1%, suggesting a very low but non-zero probability of exploitation at present. This vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to provide a crafted CIF file to a system that processes CIF input with Open Babel. Exploitation results in information disclosure; no privilege escalation or denial of service is expected based solely on the description provided.