Blender - CraftedSignal Threat Feed

Blender: Heap buffer overflow in thumbnail extractor (CVE-2026-119719)

hello@craftedsignal.io — Fri, 30 Oct 2026 17:37:37 +0000

Blender contains a heap-based buffer overflow vulnerability (CVE-2026-119719) located within the thumb_data_vertical_flip() function of the blend file thumbnail extractor. The vulnerability is triggered by a 32-bit integer overflow when processing a specially crafted .blend file.

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution or cause an application crash. The vulnerability is triggered when the blender-thumbnailer or a Windows shell extension processes a .blend file containing malicious TEST block dimensions.

Recommendation

Upgrade Blender installations to version 4.5.15 or later, or 5.2.3 or later, to address the vulnerability.
In environments where patching is delayed, restrict the automatic previewing of .blend files by disabling thumbnail shell extensions or untrusted file processing utilities.

Blender: Heap buffer overflow vulnerability in point cache parsing (CVE-2026-119718)

hello@craftedsignal.io — Fri, 30 Oct 2026 17:37:29 +0000

Blender versions prior to 4.5.15 and 5.x versions prior to 5.2.3 are affected by a heap buffer overflow vulnerability identified as CVE-2026-119718. The vulnerability originates from an integer overflow within the ptcache_data_alloc() function during the processing of point cache files.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve arbitrary code execution within the context of the user running the Blender application. If code execution is not achieved, the malformed input can cause an application crash, leading to a denial of service for the end user.

Recommendation

Upgrade Blender instances to version 4.5.15 or 5.2.3 and later to mitigate the vulnerability.
Advise users to avoid opening .blend files or associated point cache files from untrusted or unverified sources.