CVE-2025-10998 Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference

What is CVE-2025-10998?

CVE-2025-10998 is a medium-severity vulnerability in Open Babel, published on 26 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used.

Weakness: CWE-476, CWE-404

Which versions are affected by CVE-2025-10998?

3 open source packages ship an affected version, including openbabel. It affects 1 product.

Products include Openbabel Open Babel.

How do I fix CVE-2025-10998?

Upgrade openbabel to 3.2.0 or later.

Is CVE-2025-10998 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10998 exists.

Other vulnerabilities in Open Babel

• CVE-2022-41793 Open Babel has out-of-bounds write in CSR PadString (title field) Critical 9.8
• CVE-2022-42885 Open Babel has uninitialized pointer dereference in GRO residue parser Critical 9.8
• CVE-2022-43467 Open Babel has out-of-bounds write in PQS coord_file parser Critical 9.8
• CVE-2022-44451 Open Babel has uninitialized pointer dereference in MSI atom parser Critical 9.8
• CVE-2022-46280 Open Babel has uninitialized pointer dereference in PQS pFormat Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-10998, GHSA-j9pp-7wfg-q7fj, PYSEC-2026-2782, UBUNTU-CVE-2025-10998.