Live › vulnerability › CVE-2026-119721
Blender's file reader reads ID fields from short blocks without checking their length, so a crafted .blend file can read past the end of a heap buffer. An attacker can use this to crash Blender or disclose heap memory when the file is browsed or appended from.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams that open or append .blend files from sources they do not fully trust, such as downloaded assets or files shared by outside contractors, are exposed. Systems where Blender only opens files created internally can skip it for now.
No product ranges from the sources yet.
blender --version and compare against the fixed ranges below.4.5.15 to 4.5.155.2.3 to 5.2.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-119721")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.