CVE-2025-11000

MediumCVSS 5.5/10Last modified Oct 19, 2026

Description

A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
n/a	Open Babel	3.1.0; 3.1.1

References

https://github.com/openbabel/openbabel/issues/2826Exploit, Issue Tracking
https://github.com/user-attachments/files/22318474/poc.zipExploit
https://vuldb.com/?ctiid.325928Permissions Required, VDB Entry
https://vuldb.com/?id.325928Third Party Advisory, VDB Entry
https://vuldb.com/?submit.654066Third Party Advisory, VDB Entry

Timeline

Published: Sep 26, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-110017.87-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr CVE-2025-110027.87-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr CVE-2025-110036.4The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of d CVE-2025-110047.5The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to CVE-2025-110059.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Comman CVE-2025-110079.8The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_no CVE-2025-110089.8The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log CVE-2025-110095.1Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi CVE-2025-11015.3A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticat CVE-2025-110105.3A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file CVE-2025-110115.5A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_e CVE-2025-110127.8A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/script_parser.cpp of the