CVE-2022-46292

What it actually does

Out-of-bounds write during parsing of the Unit Cell Translation section in MOPAC files leads to arbitrary code execution.

Why it matters to the business

Systems that process molecular or chemistry data files can be compromised, allowing attackers to execute code and disrupt research, analysis, or production workflows that depend on the software.

How an attack unfolds

An attacker creates a malformed MOPAC file containing crafted data in the Unit Cell Translation section. The file is delivered to a target who opens it using the vulnerable software, triggering the memory corruption and resulting in arbitrary code execution.

How to fix it

Upgrade Open Babel to a version that corrects the MOPAC parsing logic; avoid processing untrusted files until patched.

How to confirm the fix worked

Confirm the installed version is newer than the vulnerable commit, then test file parsing with both benign and known-malformed MOPAC samples to verify absence of crashes or unexpected behavior.

Typical attack path

1. Craft a malicious MOPAC file with malformed Unit Cell Translation data
2. Deliver the file to the target via email, download, or shared storage
3. Victim opens the file using the vulnerable Open Babel parser
4. Out-of-bounds write occurs and attacker-controlled code executes

How to detect it

Monitor process logs and crash reports for Open Babel when handling MOPAC files; look for unexpected memory faults or execution anomalies during translation vector parsing.

What your security team should do

• Block or sandbox processing of untrusted MOPAC files until updates are applied
• Update Open Babel across all affected systems as soon as a fixed release is available
• Review and restrict file-handling workflows that accept external molecular data files