Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge (CVE-2026-2705) | HOL Guard CVE