CVE-2025-11000 Open Babel PQSformat.cpp ReadMolecule null pointer dereference
A local attacker can cause a denial of service via null pointer dereference in Open Babel's PQS format parser.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11000?
CVE-2025-11000 is a medium-severity vulnerability in Open Babel, published on 26 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
Which versions are affected by CVE-2025-11000?
3 open source packages ship an affected version, including openbabel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openbabel PyPI | All versions | 3.2.0 |
openbabel PyPI | All versions | 3.2.0 |
openbabel PyPI | All versions | 3.2.0 |
Products include Openbabel Open Babel.
How do I fix CVE-2025-11000?
Upgrade openbabel to 3.2.0 or later.
Is CVE-2025-11000 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11000 exists.
Other vulnerabilities in Open Babel
- CVE-2022-41793 Open Babel has out-of-bounds write in CSR PadString (title field)
- CVE-2022-42885 Open Babel has uninitialized pointer dereference in GRO residue parser
- CVE-2022-43467 Open Babel has out-of-bounds write in PQS coord_file parser
- CVE-2022-44451 Open Babel has uninitialized pointer dereference in MSI atom parser
- CVE-2022-46280 Open Babel has uninitialized pointer dereference in PQS pFormat
Sources
Also known as DEBIAN-CVE-2025-11000, GHSA-m982-7q3h-r784, PYSEC-2026-2785, UBUNTU-CVE-2025-11000.