CVE-2022-46289

What it actually does

Out-of-bounds write due to integer wrap-around in nAtoms calculation within ORCA file parsing, resulting in undersized buffer allocation and subsequent memory corruption that enables arbitrary code execution.

Why it matters to the business

Attackers can execute arbitrary code on systems that parse untrusted molecular data files, leading to full system compromise, data theft, or ransomware deployment in environments using this chemistry toolkit for research or processing pipelines.

How an attack unfolds

An attacker crafts a malformed ORCA file that triggers wrap-around during nAtoms processing. When the victim opens the file with Open Babel, the resulting undersized allocation is overwritten, allowing shellcode execution without authentication.

How to fix it

Upgrade to a version of Open Babel containing the fix for the nAtoms wrap-around in ORCA parsing; if no official release is available, apply the patch from commit after 530dbfa3 or replace the library with a maintained alternative until fixed packages are published.

How to confirm the fix worked

Confirm the installed Open Babel version is newer than 3.1.1 and does not contain commit 530dbfa3; test parsing of known-malformed ORCA samples in a sandbox to verify absence of crashes or code execution.

Typical attack path

1. Attacker creates specially malformed ORCA file exploiting nAtoms wrap-around
2. Victim receives file via email, download, or shared storage
3. Victim opens file using Open Babel or dependent application
4. Parser allocates undersized buffer and performs out-of-bounds write
5. Attacker-controlled code executes with privileges of the parsing process

How to detect it

Review process creation and file-access logs for Open Babel invocations against recently received or unusual molecular files; look for segmentation faults or unexpected child processes spawned during parsing of ORCA files.

What your security team should do

• Immediately restrict Open Babel usage to trusted files only and isolate parsing workloads
• Monitor for new fixed releases and schedule urgent upgrade once available
• Scan all internal repositories and build pipelines for the vulnerable 3.1.1 version
• Implement file-type sandboxing or content-disarmament for molecular data files