An issue in Open Babel versions up to 3.1.1 allows an attacker to trigger a null‑pointer dereference inside the CDXML file handler when the function OBAtom::GetExplicitValence is called. This defect can cause the application to crash, leading to a denial of service. The flaw is formally categorized as a null pointer dereference, an out‑of‑bounds write, and an improper resource release. A successful exploitation would compromise the availability of the affected system.

Open Babel, a cheminformatics toolkit used in chemistry and bio‑informatics, is affected in all releases up to and including 3.1.1. The source code affected resides in the CDXML file handler module (atom.cpp).

The risk is moderate with a CVSS score of 5.3 and a very low EPSS probability (<1 %). However the vulnerability has a publicly available exploit and can be triggered remotely via crafted CDXML files, making it a realistic threat to users who load untrusted data. Because the issue arises from a null pointer dereference, any process that invokes OBAtom::GetExplicitValence on a malformed CDXML file could crash. The KEV listing does not record this vulnerability, but the presence of an exploit means that it should be addressed promptly.