CVE-2026-119721 in Blender
Summary
by MITRE • 10/30/2026
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Blender versions prior to 4.5.15 and the 5.x series before version 5.2.3 represents a critical security flaw within the application's file parsing logic, specifically located in the blo_bhead_id_* accessor functions found in readfile.cc. This component is responsible for reading ID fields from .blend files, which are Blender's native project format containing scene data, models, animations, and other assets. The core technical deficiency lies in the absence of block length validation during the parsing process. When the software processes a file, it accesses these ID blocks without verifying that the declared or expected size matches the actual available data in the buffer. This lack of boundary checking creates an out-of-bounds read condition, allowing the application to access memory locations beyond the intended allocation limits defined by the file structure.
From an operational perspective, this vulnerability can be exploited through a social engineering vector where an attacker distributes a maliciously crafted .blend file. The attack is triggered when a victim opens such a file or attempts to append data from it within Blender. Because the parser does not enforce strict length checks on ID blocks, supplying files with truncated or artificially short block definitions causes the application to read beyond the allocated heap memory boundaries. This results in heap over-reads, which can lead to immediate application crashes due to segmentation faults or access violations. More critically, these out-of-bounds reads can result in the disclosure of sensitive information residing in adjacent heap memory regions. An attacker could potentially extract cryptographic keys, session tokens, clipboard contents, or other private data stored in memory at the time of exploitation, turning a simple file opening action into a significant privacy and security breach.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads past the end of an allocated buffer. It also relates to CWE-20, Improper Input Validation, as the application fails to adequately verify that the input data conforms to expected structural constraints before processing. In terms of the MITRE ATT&CK framework, this exploit scenario maps to T1553.004, Subversion Trust Mechanisms: Mark-of-the-Windows, if the file is downloaded from a web browser and executed via user interaction, but more directly it falls under initial access vectors involving malicious files designed to trigger memory corruption or information disclosure upon execution by trusted software like Blender. The attack requires no remote code execution capabilities initially but serves as a potent vector for reconnaissance and data exfiltration through side-channel effects of memory leakage.
Mitigation strategies primarily involve updating the affected software to version 4.5.15 or later, or version 5.2.3 and above in the 5.x branch, where these boundary checks have been implemented by the developers. Until an update is applied, users should exercise extreme caution when opening .blend files from untrusted sources, such as email attachments, file-sharing platforms, or social media links. Implementing application whitelisting policies can restrict the execution of Blender to authorized personnel only, reducing the attack surface. Additionally, deploying endpoint detection and response solutions that monitor for abnormal memory access patterns in creative software suites may help detect exploitation attempts in real-time. Security teams should also ensure that all third-party plugins or add-ons integrated with Blender are updated, as they often interact with similar file parsing mechanisms and could introduce analogous vulnerabilities if not properly maintained by their respective developers.