CVE-2022-44451

What it actually does

Use of an uninitialized pointer during parsing of the atom section in MSI format files leads to out-of-bounds memory access and arbitrary code execution when a malformed file is processed.

Why it matters to the business

Systems that parse untrusted chemistry or molecular files can be fully compromised, allowing attackers to run code, steal data, or deploy malware with no user privileges beyond opening the file.

How an attack unfolds

An attacker crafts a specially malformed MSI file that triggers the uninitialized pointer when parsed; the victim opens the file with Open Babel (via CLI, GUI, or library call); the pointer dereference is hijacked to execute attacker-controlled code.

How to fix it

Upgrade Open Babel to a patched release once available; until then restrict processing of untrusted MSI files, sandbox the binary, or remove MSI format support via build configuration.

How to confirm the fix worked

Confirm Open Babel version is newer than 3.1.1 with the MSI parser fix applied; attempt to parse known-good and known-malformed test files in a controlled environment to verify absence of crashes or unexpected execution.

Typical attack path

1. Create malformed MSI file exploiting uninitialized pointer
2. Deliver file via email, download link, or shared storage
3. Victim opens file with Open Babel or a dependent application
4. Pointer dereference executes attacker-supplied code
5. Establish persistence or exfiltrate data

How to detect it

Review process execution logs and crash dumps for Open Babel when handling MSI files; look for unexpected child processes, memory corruption signals, or segmentation faults immediately after file open events.

What your security team should do

• Inventory all instances of Open Babel and dependent chemistry toolchains
• Block untrusted MSI files from entering processing pipelines until patched
• Monitor vendor releases and apply updates immediately when published
• Add file-type sandboxing for any remaining legacy Open Babel usage