CVE-2026-119722 in Blender
Summary
by MITRE • 10/30/2026
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability resides within the core data structure parsing logic of Blender versions prior to 4.5.15 and 5.x prior to 5.2.3, specifically affecting the read_struct function responsible for deserializing .blend files. This critical flaw stems from an insufficient validation mechanism when processing Struct Data Network SDNA layouts. Under normal operation, the software expects a specific structural layout defined by the SDNA header which dictates how fields are aligned and sized within memory blocks. However, in this vulnerable implementation, if the incoming file's SDNA struct layout compares equal to the expected internal representation, the application bypasses standard size validation checks for individual data blocks. This optimization or logic error creates a dangerous assumption that all subsequent block sizes will conform to expectations without explicit verification of their actual byte length against allocated memory boundaries.
The technical consequence of this oversight is a heap out-of-bounds access condition. When an attacker supplies a crafted .blend file containing short blocks, the parser proceeds to read fields and perform writes based on incorrect or assumed size parameters rather than validated ones. Because the validation step was skipped due to the SDNA layout match, the application may attempt to write data beyond the allocated heap buffer associated with that specific block. This memory corruption allows for arbitrary reads from adjacent heap regions and uncontrolled writes into neighboring memory structures. Such behavior fundamentally breaks the isolation guarantees provided by modern operating systems' memory management units, leading directly to undefined behavior within the process space.
The operational impact of this vulnerability is severe, encompassing both denial of service and potential remote code execution scenarios. In its most benign manifestation, the heap overflow triggers immediate application crashes due to segmentation faults or access violations when the corrupted pointers are dereferenced. However, in more sophisticated exploitation contexts, an attacker can leverage the arbitrary write capability to overwrite function pointers, exception handling structures, or other control flow data within the heap. This enables the injection and execution of malicious code with the privileges of the user running Blender. Given that .blend files are frequently shared among artists and developers, this vulnerability poses a significant risk in collaborative workflows where untrusted assets might be imported without rigorous sanitization.
From a classification perspective, this issue aligns closely with CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-787 Out-of-bounds Write. The specific mechanism of skipping validation based on structural equivalence also reflects aspects of CWE-20 Improper Input Validation. In the context of the MITRE ATT&CK framework, this vulnerability facilitates initial access through lure-based techniques where a malicious file is presented as legitimate content. Once executed, it allows for privilege escalation and command execution depending on the target environment's security controls.
Mitigation strategies must prioritize immediate software updates to versions 4.5.15 or later and 5.2.3 or later, which address this logic flaw by enforcing strict size validation regardless of SDNA layout comparisons. Organizations relying on Blender for production pipelines should implement network-level filtering to restrict the ingestion of .blend files from untrusted sources until patches are applied. Additionally, enabling heap protection mechanisms such as Address Space Layout Randomization ASLR and Data Execution Prevention DEP can mitigate exploitation success rates by making memory address prediction more difficult for attackers attempting to chain this vulnerability with other exploits.