Read the docs
TI-2026-83194 Aliases CVE-2026-119719GHSA-27m9-m9xq-2vm6

Heap buffer overflow in Blender thumbnail extraction

Priority LOW 38CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Blender before 4.5.15 and from 5.0.0 before 5.2.3 contains a heap buffer overflow in the blend file thumbnail extractor. A 32-bit integer overflow in thumb_data_vertical_flip() (CWE-190) causes an out-of-bounds write. An attacker can craft a .blend file with malicious TEST block dimensions that triggers the write when blender-thumbnailer or the Windows shell extension previews it. Successful exploitation can cause crashes or code execution, and a user only needs to preview the file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix Fixed Blender (Blender Foundation): 4.5.15, 5.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BlenderBlenderbefore 4.5.15; 5.0.0 to before 5.2.34.5.15, 5.2.3Patch availableCNA
  • Blender VendorBlender Affected before 4.5.15; 5.0.0 to before 5.2.3 Fixed in 4.5.15, 5.2.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*before 4.5.15; 5.0.0 to before 5.2.3VulnerableBlender
  • cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:* Versions before 4.5.15; 5.0.0 to before 5.2.3 Vulnerable ·Blender

Remediation

Update Blender to 4.5.15 or 5.2.3, the fixed versions for the affected ranges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Blender (Blender Foundation) Fixed in 4.5.15, 5.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Blender 4.5.15, 5.2.3

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-83197 Heap out-of-bounds access in Blender read_struct() lets attackers run codePriority LOW 38
    • TI-2026-83193 Heap buffer overflow in Blender point cache file readingPriority LOW 38
    • TI-2026-83196 Blender Out-of-Bounds Read via blo_bhead_id AccessorsPriority LOW 30
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119719
  2. 2026-10-30 Affected versions changed · Red Hat
  3. 2026-10-30 CVSS score added · Red Hat
  4. 2026-10-30 Alias added: GHSA-27m9-m9xq-2vm6
  5. 2026-11-01 Priority changed: MEDIUM → LOW
  6. 2026-11-04 CISA SSVC decision points changed

References

Patch 3

Other 1

  • TI-2009-03658 Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 9.3
  • TI-2007-01216 Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h… CVSS 2.0HIGH 9.3
  • TI-2005-03127 Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute… CVSS 3.1HIGH 7.3
  • TI-2017-02138 Integer overflow in Blender CVSS 3.1HIGH 7.8
  • TI-2005-02979 Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2026-83197 Heap out-of-bounds access in Blender read_struct() lets attackers run code CVSS 4.0HIGH 8.5
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences