DEBIAN-CVE-2026-119720: Medium severity debian/blender vulnerability
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of affected Blender versions are exposed when they open an attacker-supplied or otherwise untrusted .blend file. The issue is locally triggered and requires user interaction to open the crafted file.
What does successful exploitation do?
A crafted .blend file with a truncated GLOB block can cause Blender to perform a heap out-of-bounds read in read_file_dna(). Based on the available information, the resulting impact is a Blender crash and denial of service; no confidentiality or integrity impact is stated.
Which versions should be updated?
Blender versions before 4.5.15 and 5.x versions before 5.2.3 are affected. Update to 4.5.15 or later in the 4.5 series, or to 5.2.3 or later in the 5.x series.