Open Babel, up to version 3.1.1, contains an out-of-bounds read in the OBAtom::SetFormalCharge function within the MOL2 File Handler, a classic buffer over-read weakness (CWE‑119/CWE‑125). The defect allows a maliciously crafted MOL2 file to cause the program to read memory beyond the intended buffer. Because the read can expose internal data or corrupt memory, an attacker may retrieve sensitive information or, in the worst case, trigger additional undefined behavior that could lead to remote code execution.

All deployments of Open Babel 3.1.1 or earlier are affected. The vulnerability is present in the Open Babel library component that parses MOL2 files.

The flaw has a CVSS score of 5.3, indicating a medium severity impact. The likelihood of exploitation in the wild is very low, and the vulnerability has not been recorded in CISA’s Known Exploited Vulnerabilities catalog. Nevertheless, the exploit is publicly available and can be triggered remotely by supplying a crafted MOL2 file. A patch with commit hash e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a resolves the issue; attackers that succeed before the patch are risking information disclosure or potential code execution depending on the environment.