CVE-2026-119718 in Blender
Summary
by MITRE • 10/30/2026
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the core data handling mechanisms of Blender, specifically affecting versions prior to 4.5.15 and the 5.x series before version 5.2.3. This vulnerability is classified as a heap-based buffer overflow resulting from an integer overflow condition during the allocation process for point cache data structures. The function ptcache_data_alloc() is responsible for managing memory allocations related to simulation caches, which are critical components used in physics simulations such as fluid dynamics, cloth modeling, and particle effects. When processing these files, the software fails to adequately validate or properly handle large integer values associated with the total number of points, denoted as totpoint, leading to incorrect memory allocation sizes that do not match subsequent write operations.
The technical root cause lies in how the application calculates buffer size requirements based on user-supplied input from point cache files. An attacker can craft a malicious .blend file containing embedded or linked point cache data where the totpoint value is manipulated to exceed expected bounds. Due to integer overflow, the calculated allocation size may wrap around to a significantly smaller positive number than intended. Consequently, when the application attempts to populate this undersized buffer with actual simulation data derived from the crafted input, it writes beyond the allocated memory boundaries. This out-of-bounds write corrupts adjacent heap metadata or arbitrary memory locations, creating an unstable execution environment that can be exploited for control flow hijacking.
From a threat modeling perspective, this vulnerability aligns closely with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-Bounds Write. The exploitation potential is further contextualized within the MITRE ATT&CK framework under techniques such as T1203 Exploitation for Client Execution, where attackers leverage trusted applications to execute malicious code on a victim's system. Since Blender is frequently used by artists and designers who may open files from untrusted sources or collaborative projects without rigorous verification, the risk of successful exploitation through social engineering vectors remains high. The impact ranges from denial of service via application crashes to arbitrary code execution with the privileges of the current user, potentially leading to full system compromise if combined with other local privilege escalation techniques.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Users and organizations relying on Blender for production workflows should upgrade to version 4.5.15 or later in the 4.x branch, or version 5.2.3 or later in the 5.x branch, where these integer validation checks have been corrected by the development team. In environments where immediate patching is not feasible, operational mitigations include restricting the use of Blender to trusted internal files only and disabling automatic loading of external point cache data when possible. Security awareness training should emphasize the risks associated with opening complex 3D project files from unknown origins, particularly those involving heavy simulation caches that trigger the vulnerable code paths described above.