{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/blender/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-119719"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Blender (\u003c 4.5.15)","Blender (5.x \u003c 5.2.3)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","blender"],"_cs_type":"advisory","_cs_vendors":["Blender"],"content_html":"\u003cp\u003eBlender contains a heap-based buffer overflow vulnerability (CVE-2026-119719) located within the thumb_data_vertical_flip() function of the blend file thumbnail extractor. The vulnerability is triggered by a 32-bit integer overflow when processing a specially crafted .blend file.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to achieve arbitrary code execution or cause an application crash. The vulnerability is triggered when the blender-thumbnailer or a Windows shell extension processes a .blend file containing malicious TEST block dimensions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Blender installations to version 4.5.15 or later, or 5.2.3 or later, to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eIn environments where patching is delayed, restrict the automatic previewing of .blend files by disabling thumbnail shell extensions or untrusted file processing utilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T17:37:37Z","date_published":"2026-10-30T17:37:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-blender-overflow/","summary":"Blender versions prior to 4.5.15 and 5.x prior to 5.2.3 contain a heap buffer overflow in the thumbnail extractor that can lead to remote code execution when parsing maliciously crafted .blend files.","title":"Blender: Heap buffer overflow in thumbnail extractor (CVE-2026-119719)","url":"https://feed.craftedsignal.io/briefs/2026-10-blender-overflow/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-119718"},{"cvss":7.8,"id":"CVE-2026-119722"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Blender (\u003c 4.5.15, 5.x \u003c 5.2.3)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","blender"],"_cs_type":"advisory","_cs_vendors":["Blender Foundation"],"content_html":"\u003cp\u003eBlender versions prior to 4.5.15 and 5.x versions prior to 5.2.3 are affected by a heap buffer overflow vulnerability identified as CVE-2026-119718. The vulnerability originates from an integer overflow within the ptcache_data_alloc() function during the processing of point cache files.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to achieve arbitrary code execution within the context of the user running the Blender application. If code execution is not achieved, the malformed input can cause an application crash, leading to a denial of service for the end user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Blender instances to version 4.5.15 or 5.2.3 and later to mitigate the vulnerability.\u003c/li\u003e\n\u003cli\u003eAdvise users to avoid opening .blend files or associated point cache files from untrusted or unverified sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T17:37:46Z","date_published":"2026-10-30T17:37:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-blender-cve-2026-119718/","summary":"Blender contains a heap-based buffer overflow in the ptcache_data_alloc function, allowing attackers to trigger memory corruption and potential code execution via a maliciously crafted point cache file.","title":"Blender: Heap buffer overflow vulnerability in point cache parsing (CVE-2026-119718)","url":"https://feed.craftedsignal.io/briefs/2026-10-blender-cve-2026-119718/"}],"language":"en","title":"CraftedSignal Threat Feed - Blender","version":"https://jsonfeed.org/version/1.1"}