high advisory October 30, 2026

Blender: Heap buffer overflow in thumbnail extractor (CVE-2026-119719)

Blender versions prior to 4.5.15 and 5.x prior to 5.2.3 contain a heap buffer overflow in the thumbnail extractor that can lead to remote code execution when parsing maliciously crafted .blend files.

Triage facts

Revision 1

Applicability: Blender (< 4.5.15), Blender (5.x < 5.2.3)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Oct 30, 17:37 UTC
Vulnerabilities: 1 CVE
Source quality: A2Roughly even chance

Blender contains a heap-based buffer overflow vulnerability (CVE-2026-119719) located within the thumb_data_vertical_flip() function of the blend file thumbnail extractor. The vulnerability is triggered by a 32-bit integer overflow when processing a specially crafted .blend file.

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution or cause an application crash. The vulnerability is triggered when the blender-thumbnailer or a Windows shell extension processes a .blend file containing malicious TEST block dimensions.

Recommendation

Upgrade Blender installations to version 4.5.15 or later, or 5.2.3 or later, to address the vulnerability.
In environments where patching is delayed, restrict the automatic previewing of .blend files by disabling thumbnail shell extensions or untrusted file processing utilities.

Immediate actions

Inventory all systems with Blender installed to identify versions prior to 4.5.15 or 5.2.3.

IT Operations 24h

Threat Hunt

Monitor for crashes of blender-thumbnailer or shell-extension host processes when handling .blend files.

T1203 medium medium confidence hunt now

Data: Windows Application Event Logs (Event ID 1000 - Application Error)

Mitigations

Upgrade Blender to 4.5.15 or 5.2.3.

immediate IT Operations

CVE-2026-119719