CVE-2026-119722

EUVD-2026-114127
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
blenderblender
𝑥
< 4.5.15
CNA
blenderblender
5.0.0 ≤
𝑥
< 5.2.3
CNA
Debian logo
Debian Releases
Debian Product
Codename
blender
bookworm
vulnerable
sid
vulnerable
trixie
vulnerable
Common Weakness Enumeration
References
https://projects.blender.org/blender/blender
https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e
https://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5
https://projects.blender.org/blender/blender/pulls/164279
https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct