Live › vulnerability › CVE-2026-119720
Blender reads a GLOB block field from a .blend file without checking its declared length, causing a heap out-of-bounds read. A crafted .blend file with a truncated GLOB block crashes Blender when opened.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Anyone who opens untrusted .blend files in an affected Blender build is exposed. The flaw is in the .blend file parser, so the risk comes from the file being opened rather than from a network service. Teams that only open their own trusted files are at lower risk.
No product ranges from the sources yet.
blender --version and compare against 4.5.15 for the 4.5 line and 5.2.3 for the 5.x line.4.5.15 or later on the 4.5 line.5.2.3 or later on the 5.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
This page as .md · .json · in your agent: get_signal("CVE-2026-119720")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.