Blender: Heap buffer overflow vulnerability in point cache parsing (CVE-2026-119718)
Blender contains a heap-based buffer overflow in the ptcache_data_alloc function, allowing attackers to trigger memory corruption and potential code execution via a maliciously crafted point cache file.
CVE search metadata
CVE search record: CVE-2026-119718. Severity: high. CVSS: 7.8. KEV: no. Product: Blender (< 4.5.15, 5.x < 5.2.3). Brief: Blender: Heap buffer overflow vulnerability in point cache parsing (CVE-2026-119718). Brief link: https://feed.craftedsignal.io/briefs/2026-10-blender-cve-2026-119718/
CVE search record: CVE-2026-119722. Severity: high. CVSS: 7.8. KEV: no. Product: Blender (< 4.5.15, 5.x < 5.2.3). Brief: Blender: Heap buffer overflow vulnerability in point cache parsing (CVE-2026-119718). Brief link: https://feed.craftedsignal.io/briefs/2026-10-blender-cve-2026-119718/
Triage facts
Revision 1- Applicability
- Blender (< 4.5.15, 5.x < 5.2.3)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 30, 17:37 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for Blender (< 4.5.15, 5.x < 5.2.3) Oct 30, 17:37 via nvd
Blender versions prior to 4.5.15 and 5.x versions prior to 5.2.3 are affected by a heap buffer overflow vulnerability identified as CVE-2026-119718. The vulnerability originates from an integer overflow within the ptcache_data_alloc() function during the processing of point cache files.
Impact
Successful exploitation of this vulnerability allows an attacker to achieve arbitrary code execution within the context of the user running the Blender application. If code execution is not achieved, the malformed input can cause an application crash, leading to a denial of service for the end user.
Recommendation
- Upgrade Blender instances to version 4.5.15 or 5.2.3 and later to mitigate the vulnerability.
- Advise users to avoid opening .blend files or associated point cache files from untrusted or unverified sources.
Immediate actions
Patch Blender installations to version 4.5.15 or 5.2.3
Threat Hunt
Identify endpoints running vulnerable versions of Blender (< 4.5.15 or 5.x < 5.2.3)
Data: Endpoint inventory and software versioning logs
Identify and inventory systems running outdated Blender versions using EDR software inventory or asset management tools.
Data: Installed software versioning data
Mitigations
Upgrade Blender to 4.5.15 or 5.2.3
CVE-2026-119718
Upgrade Blender to 4.5.15 or 5.2.3 or later on all workstations.
CVE-2026-119722