---
id: "CVE-2026-119719"
kind: "vulnerability"
aliases: ["CVE-2026-119719"]
title: "Blender: crafted .blend file thumbnail preview overflows heap, enabling code execution"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Blender", "fixed": ["4.5.15", "5.2.3"], "affected": "< 4.5.15, 5.x < 5.2.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["3d-artists", "blender", "desktop", "other", "thumbnailer", "windows"]
not_affected_if: ["no-untrusted-blend-files", "thumbnail-preview-disabled", "thumbnails-disabled"]
published_at: "2026-10-30T16:17:55+00:00"
first_seen_at: "2026-10-30T16:31:26+00:00"
updated_at: "2026-10-30T16:32:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119719", "first_seen_at": "2026-10-30T16:31:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T16:32:24+00:00"}]
---

# Blender: crafted .blend file thumbnail preview overflows heap, enabling code execution

Blender's thumbnail extractor mishandles 32-bit integer math when flipping thumbnail image data, so a crafted .blend file with malicious TEST block dimensions causes an out-of-bounds heap write. An attacker can crash the thumbnailer or run code when a victim previews the file in Windows Explorer or with blender-thumbnailer.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Blender affected < 4.5.15, 5.x < 5.2.3 fixed 4.5.15, 5.2.3

## How to check

Run blender --version (or check the installed Blender folder) and compare with 4.5.15 / 5.2.3. The thumbnailer ships as blender-thumbnailer and, on Windows, the Explorer thumbnail handler; any version older than the fixed one is affected.

## Fix

Update Blender to 4.5.15 LTS or 5.2.3 LTS (or later). Until then, turn off thumbnail previews of .blend files and do not preview or open .blend files from untrusted sources.

## Timeline

- 2026-10-30T16:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119719
- 2026-10-30T16:32:24+00:00 analyst — Fix commit 6103b45a5b (PR 164279, merged 2026-10-13, backported to 5.2 LTS) validates TEST thumbnail block: min length, width/height >0 and <=4096, size match. Vendor describes it as blender-thumbnailer crash from integer overflow; code execution is NVD's claim, not stated by Blender. Fixed versions 4.5.15 / 5.2.3 (released 2026-10-22) come from NVD/release dates; changelog excerpt I read did not list this fix explicitly, so not verified. No exploitation or PoC found. Sibling CVEs 119720-119722 cover other blend-file parsing bugs in same release.

## Documents

- [fix] Blender PR 164279: Harden blend file reading (incl. corrupt thumbnail integer overflow) https://projects.blender.org/blender/blender/pulls/164279
- [fix] Blender 4.5 LTS releases (4.5.15, Oct 22 2026) https://www.blender.org/releases/4-5/

## From the sources

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_