Blender Foundation - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/blender-foundation/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:37:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBlender: Heap buffer overflow vulnerability in point cache parsing (CVE-2026-119718)https://feed.craftedsignal.io/briefs/2026-10-blender-cve-2026-119718/Fri, 30 Oct 2026 17:37:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-blender-cve-2026-119718/Blender contains a heap-based buffer overflow in the ptcache_data_alloc function, allowing attackers to trigger memory corruption and potential code execution via a maliciously crafted point cache file.Blender versions prior to 4.5.15 and 5.x versions prior to 5.2.3 are affected by a heap buffer overflow vulnerability identified as CVE-2026-119718. The vulnerability originates from an integer overflow within the ptcache_data_alloc() function during the processing of point cache files.

Impact

Successful exploitation of this vulnerability allows an attacker to achieve arbitrary code execution within the context of the user running the Blender application. If code execution is not achieved, the malformed input can cause an application crash, leading to a denial of service for the end user.

Recommendation

  • Upgrade Blender instances to version 4.5.15 or 5.2.3 and later to mitigate the vulnerability.
  • Advise users to avoid opening .blend files or associated point cache files from untrusted or unverified sources.
]]>highadvisoryvulnerabilityremote-code-executionblender