CVE-2026-119720 in Blender
Summary
by MITRE • 10/30/2026
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability resides within the core file parsing logic of Blender, specifically in the function responsible for reading DNA data structures during the initialization phase of opening a project or asset file. This heap-based out-of-bounds read occurs when the application processes GLOB blocks, which are used to store global scene data and metadata. The root cause is a critical failure in input validation where the software fails to verify that the declared length of the GLOB block field matches the actual available data within the crafted .blend file. By supplying a maliciously constructed file with a truncated or malformed GLOB block, an attacker can exploit this discrepancy to force the parser to read memory locations beyond the allocated buffer boundaries.
From a technical perspective, this flaw represents a classic instance of improper input validation leading to out-of-bounds access. When Blender attempts to parse the DNA data structure, it relies on metadata provided in the file header to determine how much data to copy or process from the disk into heap memory. If the declared length exceeds the actual size of the block present in the file, the read operation proceeds without bounds checking against the end of the allocated buffer. This results in reading arbitrary adjacent memory contents, which can lead to information disclosure if the exposed memory contains sensitive data such as cryptographic keys or user credentials stored in nearby allocations. More commonly, however, this type of vulnerability manifests as a denial-of-service condition due to segmentation faults or access violations triggered by accessing unmapped or protected memory pages.
The operational impact of this vulnerability is primarily centered around stability and availability rather than direct code execution, although the potential for information leakage remains a significant concern depending on the specific memory layout at runtime. An attacker can trigger a crash simply by convincing a user to open a specially crafted .blend file through social engineering or automated distribution mechanisms. This disrupts workflow integrity and causes data loss if unsaved work is present in the application instance when the crash occurs. While heap out-of-bounds reads are sometimes precursors to more severe exploits involving arbitrary read primitives, in this specific context within Blender's parsing engine, the immediate consequence is often a stable crash or an unhandled exception that terminates the process.
This vulnerability aligns with CWE-125, which describes Out-of-Bounds Read, and falls under the ATT&CK technique of Taint Analysis for detecting invalid memory accesses during execution. It also relates to CWE-20, Improper Input Validation, as the failure stems from not sanitizing or validating the structural integrity of the input file before processing its contents. To mitigate this risk, users must upgrade to Blender version 4.5.15 or later if running a 4.x branch, or version 5.2.3 and above for the 5.x series. These updates include patches that enforce strict length validation on GLOB blocks during the file reading process, ensuring that no data is read beyond the boundaries defined by the actual file content. Organizations relying on Blender for rendering pipelines should prioritize this update to maintain operational continuity and prevent potential denial-of-service attacks against shared workstations or render farms where users may open files from untrusted sources.