{"id":"CVE-2026-119719","kind":"vulnerability","aliases":["CVE-2026-119719"],"related":[],"title":"Blender: crafted .blend file thumbnail preview overflows heap, enabling code execution","description":"Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.","summary":"Blender's thumbnail extractor mishandles 32-bit integer math when flipping thumbnail image data, so a crafted .blend file with malicious TEST block dimensions causes an out-of-bounds heap write. An attacker can crash the thumbnailer or run code when a victim previews the file in Windows Explorer or with blender-thumbnailer.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Blender","fixed":["4.5.15","5.2.3"],"affected":"< 4.5.15, 5.x < 5.2.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["3d-artists","blender","desktop","other","thumbnailer","windows"],"not_affected_if":["no-untrusted-blend-files","thumbnail-preview-disabled","thumbnails-disabled"],"how_to_check":"Run blender --version (or check the installed Blender folder) and compare with 4.5.15 / 5.2.3. The thumbnailer ships as blender-thumbnailer and, on Windows, the Explorer thumbnail handler; any version older than the fixed one is affected.","fix":"Update Blender to 4.5.15 LTS or 5.2.3 LTS (or later). Until then, turn off thumbnail previews of .blend files and do not preview or open .blend files from untrusted sources.","status":"open","published_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:31:50+00:00","updated_at":"2026-10-30T16:32:24+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T16:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- Blender `4.5.15`\n- Blender `5.2.3`","reach":"local","title":"Blender: crafted .blend file thumbnail preview overflows heap, enabling code execution","impact":"high","summary":"Blender's thumbnail extractor mishandles 32-bit integer math when flipping thumbnail image data, so a crafted .blend file with malicious TEST block dimensions causes an out-of-bounds heap write. An attacker can crash the thumbnailer or run code when a victim previews the file in Windows Explorer or with blender-thumbnailer.","audience":"everyone","category":"other","nicknames":[],"who_cares":["blender","windows","desktop","3d-artists"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker runs code when a crafted file is previewed","analyst_note":"Confirm exploitation requirements and whether a plain file preview, not just opening in Blender, triggers the overflow; check the Blender release notes for the fix details.","how_to_check":"- Run `blender --version` and compare against the fixed ranges: below `4.5.15` or `5.0` through `5.2.2`.\n- Check whether the Windows Blender thumbnail shell extension is installed and whether Explorer previews .blend files.","plain_action":"Update Blender to version 4.5.15 or 5.2.3 or later, and avoid opening untrusted .blend files in Windows Explorer previews until you do.","needs_analyst":true,"not_affected_if":["no-untrusted-blend-files","thumbnail-preview-disabled"],"who_is_affected":"Anyone running Blender before 4.5.15 or 5.x before 5.2.3, and anyone using the blender-thumbnailer or Windows shell extension that previews .blend files. Exposure comes from a victim opening or previewing a file an attacker supplied. Teams that only use Blender on trusted local projects with no untrusted .blend files are at lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4189,"output_tokens":712,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm exploitation requirements and whether a plain file preview, not just opening in Blender, triggers the overflow; check the Blender release notes for the fix details.","search":"'-119719':14A,17A '-2026':13A,16A '32':32B,104C '3d':20B '3d-artists':19B '4.5.15':84C '5':86C '5.2.3':89C 'artist':21B 'attack':60B,113C 'bit':33B,105C 'blend':3A,44B,98C,117C 'blender':1A,18A,22B,27B,80B,82C,134C 'blender-thumbnail':79B,133C 'block':49B,122C 'bound':56B,130C 'buffer':93C 'caus':51B,102C,143C 'code':10A,67B,146C 'contain':90C 'craft':2A,43B,115C 'crash':62B,144C 'cve':12A,15A 'data':40B,110C 'desktop':23B 'dimens':50B,123C 'enabl':9A 'execut':11A,147C 'explor':76B 'extens':140C 'extractor':30B,101C 'file':4A,45B,73B,99C,118C 'flip':37B,112C 'heap':8A,57B,92C 'imag':39B 'integ':34B,106C 'malici':47B,120C 'math':35B 'mishandl':31B 'out-of-bound':53B,127C 'overflow':7A,94C,107C 'preview':6A,71B,141C 'run':66B 'shell':139C 'test':48B,121C 'thumb':109C 'thumbnail':5A,25B,29B,38B,64B,81B,100C,135C 'trigger':125C 'vertic':111C 'victim':70B 'vulner':95C 'window':26B,75B,138C 'write':58B,131C 'x':87C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Blender below 4.5.15 (LTS) or below 5.2.3 (LTS) who previews .blend files through Windows Explorer's thumbnail handler or blender-thumbnailer. This includes artists and studios and pipelines or asset sites that generate thumbnails from uploaded .blend files. Machines that never preview or handle untrusted .blend files can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":"Update Blender to version 4.5.15 or 5.2.3 or later, and avoid opening untrusted .blend files in Windows Explorer previews until you do.","first_public_at":"2026-10-30T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119719","severity":null,"published_at":"2026-10-30T16:17:55+00:00","modified_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119719:1171","url":null,"severity":null,"published_at":"2026-10-30T16:32:24+00:00","modified_at":"2026-10-30T16:32:24+00:00","first_seen_at":"2026-10-30T16:32:24+00:00","fetched_at":"2026-10-30T16:32:24+00:00","note":"Fix commit 6103b45a5b (PR 164279, merged 2026-10-13, backported to 5.2 LTS) validates TEST thumbnail block: min length, width/height >0 and <=4096, size match. Vendor describes it as blender-thumbnailer crash from integer overflow; code execution is NVD's claim, not stated by Blender. Fixed versions 4.5.15 / 5.2.3 (released 2026-10-22) come from NVD/release dates; changelog excerpt I read did not list this fix explicitly, so not verified. No exploitation or PoC found. Sibling CVEs 119720-119722 cover other blend-file parsing bugs in same release."}],"documents":[{"id":24656,"url":"https://projects.blender.org/blender/blender/pulls/164279","title":"Blender PR 164279: Harden blend file reading (incl. corrupt thumbnail integer overflow)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":24657,"url":"https://www.blender.org/releases/4-5/","title":"Blender 4.5 LTS releases (4.5.15, Oct 22 2026)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}