CVE-2025-10996 describes a heap-based buffer overflow in the OBSmilesParser::ParseSmiles function of Open Babel up to version 3.1.1. The vulnerability arises from improper handling of input data during SMILES string parsing, leading to memory corruption on the heap. Exploitation requires local access and low privileges, with no user interaction needed. The vulnerability has a medium impact score (CVSS 4.8) and public exploit code exists. No vendor advisory or patch information is currently available.

Successful exploitation of this heap-based buffer overflow can lead to memory corruption, potentially causing application crashes or arbitrary code execution with the privileges of the local user. Since the attack requires local access and low privileges, the risk is limited to local users or processes. The presence of public exploit code increases the likelihood of exploitation in vulnerable environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and avoid processing untrusted SMILES input data. Monitor vendor channels for updates regarding patches or official mitigations.