{"id":"CVE-2026-119722","kind":"vulnerability","aliases":["CVE-2026-119722"],"related":[],"title":"Blender: crafted .blend file overruns heap memory, risking code execution","description":"Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.","summary":"Blender before 4.5.15 and 5.x before 5.2.3 mishandles size checks when reading .blend files, so a crafted file can read and write past heap buffers. An attacker who gets a user to open the file can crash Blender or possibly run code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["3d-artists","blender","desktop","package"],"not_affected_if":["fixed-version","no-untrusted-blend-files"],"how_to_check":"- Run `blender --version` and compare the version against the fixed ranges.\n- List the Blender versions installed on workstations and build machines.","fix":"- Blender `4.5.15` for the 4.5 line\n- Blender `5.2.3` for the 5.x line","status":"open","published_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:27+00:00","triaged_at":"2026-10-30T16:31:49+00:00","updated_at":"2026-10-30T16:31:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T16:31:49Z","model":"claude-haiku-5-5","output":{"fix":"- Blender `4.5.15` for the 4.5 line\n- Blender `5.2.3` for the 5.x line","reach":"local","title":"Blender: crafted .blend file overruns heap memory, risking code execution","impact":"high","summary":"Blender before 4.5.15 and 5.x before 5.2.3 mishandles size checks when reading .blend files, so a crafted file can read and write past heap buffers. An attacker who gets a user to open the file can crash Blender or possibly run code.","audience":"everyone","category":"package","nicknames":[],"who_cares":["blender","desktop","3d-artists"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code as the user who opened the file","analyst_note":"","how_to_check":"- Run `blender --version` and compare the version against the fixed ranges.\n- List the Blender versions installed on workstations and build machines.","plain_action":"Update Blender to version 4.5.15 or 5.2.3 or later, and only open .blend files from people you trust until you do.","needs_analyst":false,"not_affected_if":["fixed-version","no-untrusted-blend-files"],"who_is_affected":"Anyone who opens .blend files in an affected Blender build, including files downloaded from the internet or shared by others. Pipelines that only render files created in-house and never accept outside .blend files are less exposed. unknown for whether a server-side rendering service is involved.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4165,"output_tokens":536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119722':13A,16A '-2026':12A,15A '3d':18B '3d-artists':17B '4.5.15':25B,68C '5':27B,70C '5.2.3':30B,73C 'access':81C 'artist':19B 'attack':50B,100C 'blend':3A,36B,92C,105C 'blender':1A,20B,23B,61B,66C 'block':109C 'bound':80C 'buffer':48B 'caus':120C 'check':33B 'code':9A,65B,123C 'compar':98C 'contain':74C 'craft':2A,40B,104C 'crash':60B,121C 'cve':11A,14A 'derefer':116C 'desktop':21B 'equal':99C 'execut':10A,124C 'field':111C 'file':4A,37B,41B,58B,93C,106C 'get':52B 'heap':6A,47B,76C,118C 'layout':97C 'memori':7A,119C 'mishandl':31B 'open':56B 'out-of-bound':77C 'overrun':5A,117C 'packag':22B 'past':46B 'pointer':115C 'possibl':63B 'read':35B,43B,84C,112C 'risk':8A 'run':64B 'sdna':95C 'short':108C 'size':32B,88C 'skip':87C 'struct':85C,96C 'suppli':102C 'user':54B 'valid':89C 'vulner':82C 'write':45B,113C 'x':28B,71C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens .blend files in an affected Blender build, including files downloaded from the internet or shared by others. Pipelines that only render files created in-house and never accept outside .blend files are less exposed. unknown for whether a server-side rendering service is involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Blender to version 4.5.15 or 5.2.3 or later, and only open .blend files from people you trust until you do.","first_public_at":"2026-10-30T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119722","severity":null,"published_at":"2026-10-30T16:17:55+00:00","modified_at":"2026-10-30T16:17:55+00:00","first_seen_at":"2026-10-30T16:31:27+00:00","fetched_at":"2026-10-30T16:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}