Blender (< 4.5.15) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/blender--4.5.15/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:37:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBlender: Heap buffer overflow in thumbnail extractor (CVE-2026-119719)https://feed.craftedsignal.io/briefs/2026-10-blender-overflow/Fri, 30 Oct 2026 17:37:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-blender-overflow/Blender versions prior to 4.5.15 and 5.x prior to 5.2.3 contain a heap buffer overflow in the thumbnail extractor that can lead to remote code execution when parsing maliciously crafted .blend files.Blender contains a heap-based buffer overflow vulnerability (CVE-2026-119719) located within the thumb_data_vertical_flip() function of the blend file thumbnail extractor. The vulnerability is triggered by a 32-bit integer overflow when processing a specially crafted .blend file.

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution or cause an application crash. The vulnerability is triggered when the blender-thumbnailer or a Windows shell extension processes a .blend file containing malicious TEST block dimensions.

Recommendation

  • Upgrade Blender installations to version 4.5.15 or later, or 5.2.3 or later, to address the vulnerability.
  • In environments where patching is delayed, restrict the automatic previewing of .blend files by disabling thumbnail shell extensions or untrusted file processing utilities.
]]>highadvisoryvulnerabilityremote-code-executionblender