DEBIAN-CVE-2026-119721: Medium severity debian/blender vulnerability
Published Oct 30, 2026
·Updated
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blobheadid accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
Affected Software
2 affected components
debian/blender*
debian/blender*
Event History
Oct 30, 2026
CVE Published
via OSV·04:17 PM
Data Sourced
via OSV·04:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What user action is required for exploitation?
An attacker must provide a crafted .blend file. The issue is triggered when the file is browsed or content is appended from it, so user interaction is required.
2
What is the practical impact of successful exploitation?
A crafted file can cause heap out-of-bounds reads, resulting in Blender crashes or disclosure of heap memory.
3
How can I determine whether an installation is affected?
Check the installed Blender version. Releases before 4.5.15 and 5.x releases before 5.2.3 are affected.