{"id":"CVE-2026-119720","kind":"vulnerability","aliases":["CVE-2026-119720"],"related":[],"title":"Blender: crafted .blend file triggers heap out-of-bounds read and crash","description":"Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.","summary":"Blender reads a GLOB block field from a .blend file without checking its declared length, causing a heap out-of-bounds read. A crafted .blend file with a truncated GLOB block crashes Blender when opened.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["3d","blender","creative-tools","package"],"not_affected_if":["blender-4.5.15-or-later","blender-5.2.3-or-later"],"how_to_check":"- Run `blender --version` and compare against `4.5.15` for the 4.5 line and `5.2.3` for the 5.x line.\n- Check whether the installed Blender is older than these versions.","fix":"- Move to `4.5.15` or later on the 4.5 line.\n- Move to `5.2.3` or later on the 5.x line.","status":"open","published_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:27+00:00","triaged_at":"2026-10-30T16:32:19+00:00","updated_at":"2026-10-30T16:32:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T16:32:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `4.5.15` or later on the 4.5 line.\n- Move to `5.2.3` or later on the 5.x line.","reach":"local","title":"Blender: crafted .blend file triggers heap out-of-bounds read and crash","impact":"low","summary":"Blender reads a GLOB block field from a .blend file without checking its declared length, causing a heap out-of-bounds read. A crafted .blend file with a truncated GLOB block crashes Blender when opened.","audience":"developers","category":"package","nicknames":[],"who_cares":["blender","3d","creative-tools"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Blender crashes when a crafted file is opened","analyst_note":"","how_to_check":"- Run `blender --version` and compare against `4.5.15` for the 4.5 line and `5.2.3` for the 5.x line.\n- Check whether the installed Blender is older than these versions.","plain_action":"","needs_analyst":false,"not_affected_if":["blender-4.5.15-or-later","blender-5.2.3-or-later"],"who_is_affected":"Anyone who opens untrusted .blend files in an affected Blender build is exposed. The flaw is in the .blend file parser, so the risk comes from the file being opened rather than from a network service. Teams that only open their own trusted files are at lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4159,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119720':16A,19A '-2026':15A,18A '3d':20B '4.5.15':64C '5':66C '5.2.3':69C 'attack':94C 'blend':3A,34B,51B,99C 'blender':1A,21B,26B,59B,62C,118C 'block':30B,57B,87C,105C 'bound':10A,47B,76C,114C 'caus':41B 'check':37B 'contain':70C 'craft':2A,50B,98C 'crash':13A,58B,117C 'creativ':23B 'creative-tool':22B 'cve':14A,17A 'declar':39B,92C 'dna':82C 'field':31B,88C 'file':4A,35B,52B,81C,100C 'glob':29B,56B,86C,104C 'heap':6A,43B,72C 'length':40B,93C 'open':61B,108C 'out-of-bound':7A,44B,73C,111C 'packag':25B 'read':11A,27B,48B,77C,80C,84C,115C 'suppli':96C 'tool':24B 'trigger':5A,109C 'truncat':55B,103C 'valid':90C 'vulner':78C 'without':36B,89C 'x':67C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens untrusted .blend files in an affected Blender build is exposed. The flaw is in the .blend file parser, so the risk comes from the file being opened rather than from a network service. Teams that only open their own trusted files are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119720","severity":null,"published_at":"2026-10-30T16:17:55+00:00","modified_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:27+00:00","fetched_at":"2026-10-30T16:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}