{"id":"CVE-2026-119718","kind":"vulnerability","aliases":["CVE-2026-119718"],"related":[],"title":"Blender: crafted point cache file overflows heap, runs code as user","description":"Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.","summary":"Blender's point cache reader multiplies an unchecked count when allocating memory, so a crafted cache file alongside a .blend file causes a heap buffer overflow. An attacker who gets a user to open such files can crash Blender or execute code with that user's privileges.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["3d-artists","blender","desktop","package"],"not_affected_if":["only-trusted-files","patched-version"],"how_to_check":"- Run `blender --version` and compare against `4.5.15` for the 4.5 line and `5.2.3` for the 5.x line.\n- Check whether the installed build is from the official Blender release or a packaged distribution that may ship its own version.","fix":"- Blender 4.5 line: `4.5.15` or later\n- Blender 5.x line: `5.2.3` or later","status":"open","published_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:31:49+00:00","updated_at":"2026-10-30T16:31:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T16:31:49Z","model":"claude-haiku-5-5","output":{"fix":"- Blender 4.5 line: `4.5.15` or later\n- Blender 5.x line: `5.2.3` or later","reach":"local","title":"Blender: crafted point cache file overflows heap, runs code as user","impact":"high","summary":"Blender's point cache reader multiplies an unchecked count when allocating memory, so a crafted cache file alongside a .blend file causes a heap buffer overflow. An attacker who gets a user to open such files can crash Blender or execute code with that user's privileges.","audience":"everyone","category":"package","nicknames":[],"who_cares":["blender","3d-artists","desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Code runs as the user who opens the crafted files.","analyst_note":"","how_to_check":"- Run `blender --version` and compare against `4.5.15` for the 4.5 line and `5.2.3` for the 5.x line.\n- Check whether the installed build is from the official Blender release or a packaged distribution that may ship its own version.","plain_action":"Update Blender to version 4.5.15 or 5.2.3 or later, and only open .blend files from sources you trust.","needs_analyst":false,"not_affected_if":["patched-version","only-trusted-files"],"who_is_affected":"Anyone who opens a .blend file together with a point cache file from an untrusted source in an affected Blender version. Studios and artists who only open their own project files are much less exposed, and the sources do not say whether a file opened by itself triggers the flaw.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":4149,"output_tokens":566,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119718':14A,17A '-2026':13A,16A '3d':19B '3d-artists':18B '4.5.15':73C '5':75C '5.2.3':78C 'alloc':34B,92C 'alongsid':41B,111C 'artist':20B 'attack':51B,98C 'blend':43B,113C 'blender':1A,21B,24B,62B,71C,117C 'buffer':48B,82C 'cach':4A,27B,39B,96C,104C 'caus':45B,85C 'code':9A,65B,120C 'contain':79C 'count':32B 'craft':2A,38B,102C 'crash':61B,116C 'cve':12A,15A 'data':91C 'desktop':22B 'execut':64B,119C 'file':5A,40B,44B,59B,97C,105C,114C 'get':53B 'heap':7A,47B,81C 'integ':87C 'larg':108C 'memori':35B 'multipli':29B 'open':57B 'overflow':6A,49B,83C,88C 'packag':23B 'point':3A,26B,95C,103C 'privileg':70B 'ptcach':90C 'read':94C 'reader':28B 'run':8A 'suppli':100C 'totpoint':109C 'uncheck':31B 'user':11A,55B,68B,123C 'valu':110C 'vulner':84C 'x':76C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens a .blend file together with a point cache file from an untrusted source in an affected Blender version. Studios and artists who only open their own project files are much less exposed, and the sources do not say whether a file opened by itself triggers the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Blender to version 4.5.15 or 5.2.3 or later, and only open .blend files from sources you trust.","first_public_at":"2026-10-30T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119718","severity":null,"published_at":"2026-10-30T16:17:55+00:00","modified_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}