CVE-2022-37331

What it actually does

Out-of-bounds write in Gaussian format orientation parsing leads to arbitrary code execution when processing a malformed file.

Why it matters to the business

Attackers can gain full control of systems that process untrusted chemical structure files, enabling data theft, ransomware deployment, or lateral movement in research and scientific computing environments; exploit code is publicly available and the vulnerability remains unpatched in listed versions.

How an attack unfolds

An attacker creates a specially crafted Gaussian-format file that triggers an out-of-bounds write during orientation handling; the file is delivered to a victim who opens it with Open Babel (via CLI, GUI, or library integration), causing the write to corrupt memory and execute attacker-supplied code.

How to fix it

No fixed versions are listed; immediately upgrade Open Babel to the latest master or any subsequent release that resolves the Gaussian parser issue, sandbox all file processing, and avoid handling untrusted Gaussian files until patched builds are available.

How to confirm the fix worked

Confirm Open Babel version is newer than 3.1.1 and commit 530dbfa3; fuzz the Gaussian parser with known-malformed test cases and verify no crashes or unexpected memory writes occur.

Typical attack path

1. Craft malformed Gaussian file exploiting orientation parsing
2. Deliver file via email, download, or shared storage
3. Victim opens or converts the file using Open Babel
4. Out-of-bounds write occurs and payload executes

How to detect it

Review process creation logs and file-access events around Open Babel execution; look for crashes, unexpected child processes, or memory-corruption indicators when Gaussian files are processed.

• openbabel process spawning cmd.exe or powershell.exe
• Gaussian file with malformed ORI section
• Access violation or segfault in obabel when reading .gau or .log files

What your security team should do

• Treat all Gaussian files from external sources as untrusted and block or sandbox their processing
• Monitor for new Open Babel releases and deploy as soon as available given public exploit existence
• Add file-type and content scanning rules for Gaussian format in mail and file gateways
• Audit all internal workflows that invoke Open Babel on user-supplied data