Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString (CVE-2026-2704) | HOL Guard CVE