CVE-2026-119719: Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction

Q: Which systems are most exposed to this issue?

Systems that automatically generate or display previews for untrusted .blend files are most exposed. The vulnerable paths specifically include blender-thumbnailer and the Windows shell extension.

Q: What must an attacker do to trigger the vulnerability?

An attacker needs to provide a crafted .blend file containing malicious TEST block dimensions. Triggering occurs when the file is previewed or processed for thumbnail extraction, and user interaction is required according to the supplied CVSS vector.

Q: Are current Blender releases affected?

The issue affects Blender releases before 4.5.15 and 5.x releases before 5.2.3. The provided data does not identify other affected version branches.

Q: What is the impact if exploitation succeeds?

The malformed thumbnail data can cause an out-of-bounds heap write. This may result in a crash or code execution.

Published Oct 30, 2026

Updated

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.

Affected Software

12 affected components

debian/blender*

debian/blender<=3.4.1+dfsg-2, <=4.3.2+dfsg-2, <=5.2.2+dfsg-1

Blender Blender<4.5.15

Blender Blender>=5.0.0<5.2.3

ubuntu/blender*

Event History

Oct 30, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are most exposed to this issue?

Systems that automatically generate or display previews for untrusted .blend files are most exposed. The vulnerable paths specifically include blender-thumbnailer and the Windows shell extension.

What must an attacker do to trigger the vulnerability?

An attacker needs to provide a crafted .blend file containing malicious TEST block dimensions. Triggering occurs when the file is previewed or processed for thumbnail extraction, and user interaction is required according to the supplied CVSS vector.

Are current Blender releases affected?

The issue affects Blender releases before 4.5.15 and 5.x releases before 5.2.3. The provided data does not identify other affected version branches.

What is the impact if exploitation succeeds?

The malformed thumbnail data can cause an out-of-bounds heap write. This may result in a crash or code execution.

CVE-2026-119719: Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction

Affected Software

Event History

Frequently Asked Questions

Which systems are most exposed to this issue?

What must an attacker do to trigger the vulnerability?

Are current Blender releases affected?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most exposed to this issue?

What must an attacker do to trigger the vulnerability?

Are current Blender releases affected?

What is the impact if exploitation succeeds?