Read the docs
TI-2026-83197 Aliases CVE-2026-119722GHSA-xrhr-77c8-rr8q

Heap out-of-bounds access in Blender read_struct() lets attackers run code

Priority LOW 38CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Blender before 4.5.15 and from 5.0.0 before 5.2.3 contains a heap out-of-bounds access in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. An unauthenticated attacker can supply a crafted .blend file with short blocks so that field reads, writes and pointer dereferences overrun heap memory, which can crash Blender or lead to code execution if a user opens the file. The flaw is tracked as CWE-125.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00178 7th percentileScored 2026-11-07
Fix Fixed Blender (Blender Foundation): 4.5.15, 5.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BlenderBlenderbefore 4.5.15; 5.0.0 to before 5.2.34.5.15, 5.2.3Patch availableCNA
  • Blender VendorBlender Affected before 4.5.15; 5.0.0 to before 5.2.3 Fixed in 4.5.15, 5.2.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*before 4.5.15; 5.0.0 to before 5.2.3VulnerableBlender
  • cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:* Versions before 4.5.15; 5.0.0 to before 5.2.3 Vulnerable ·Blender

Remediation

Update Blender to version 4.5.15 or 5.2.3. Red Hat lists its Blender product as not affected, and the sources give no fixed version for it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Blender (Blender Foundation) Fixed in 4.5.15, 5.2.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Blender 4.5.15, 5.2.3

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-83194 Heap buffer overflow in Blender thumbnail extractionPriority LOW 38
    • TI-2026-83193 Heap buffer overflow in Blender point cache file readingPriority LOW 38
    • TI-2026-83196 Blender Out-of-Bounds Read via blo_bhead_id AccessorsPriority LOW 30
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119722
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Affected versions changed · Red Hat
  5. 2026-10-30 CVSS score added · Red Hat
  6. 2026-10-30 Alias added: GHSA-xrhr-77c8-rr8q

References

Patch 3

Other 1

  • TI-2009-03658 Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 9.3
  • TI-2007-01216 Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h… CVSS 2.0HIGH 9.3
  • TI-2005-03127 Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute… CVSS 3.1HIGH 7.3
  • TI-2017-02138 Integer overflow in Blender CVSS 3.1HIGH 7.8
  • TI-2005-02979 Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2026-83194 Heap buffer overflow in Blender thumbnail extraction CVSS 4.0HIGH 8.5
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences