Read the docs
TI-2026-83193 Aliases CVE-2026-119718GHSA-998f-5325-f384

Heap buffer overflow in Blender point cache file reading

Priority LOW 38CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Blender before 4.5.15 and from 5.0.0 before 5.2.3 is affected. An integer overflow in ptcache_data_alloc() causes a heap buffer overflow when point cache files are read (CWE-190). An attacker who supplies a crafted point cache file alongside a .blend file can crash Blender or execute code as the user who opens it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed Blender (Blender Foundation): 4.5.15, 5.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BlenderBlenderbefore 4.5.15; 5.0.0 to before 5.2.34.5.15, 5.2.3Patch availableCNA
  • Blender VendorBlender Affected before 4.5.15; 5.0.0 to before 5.2.3 Fixed in 4.5.15, 5.2.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*before 4.5.15; 5.0.0 to before 5.2.3VulnerableBlender
  • cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:* Versions before 4.5.15; 5.0.0 to before 5.2.3 Vulnerable ·Blender

Remediation

Upgrade to Blender 4.5.15 for the 4.x branch or to Blender 5.2.3 for the 5.x branch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Blender (Blender Foundation) Fixed in 4.5.15, 5.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Blender 4.5.15, 5.2.3

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-83197 Heap out-of-bounds access in Blender read_struct() lets attackers run codePriority LOW 38
    • TI-2026-83194 Heap buffer overflow in Blender thumbnail extractionPriority LOW 38
    • TI-2026-83196 Blender Out-of-Bounds Read via blo_bhead_id AccessorsPriority LOW 30
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119718
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Affected versions changed · Red Hat
  5. 2026-10-30 CVSS score added · Red Hat
  6. 2026-10-30 Alias added: GHSA-998f-5325-f384

References

Patch 3

Other 1

  • TI-2009-03658 Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 9.3
  • TI-2007-01216 Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h… CVSS 2.0HIGH 9.3
  • TI-2005-03127 Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute… CVSS 3.1HIGH 7.3
  • TI-2017-02138 Integer overflow in Blender CVSS 3.1HIGH 7.8
  • TI-2005-02979 Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2026-83197 Heap out-of-bounds access in Blender read_struct() lets attackers run code CVSS 4.0HIGH 8.5
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences