UBUNTU-CVE-2026-119720: Medium severity ubuntu/blender vulnerability
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds read and crashes Blender.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of affected Blender versions are exposed when they open a crafted .blend file. Exploitation requires user interaction; the malicious file must be opened in Blender.
What is the practical impact of successful exploitation?
The documented impact is a Blender crash caused by an out-of-bounds read. The provided severity vector indicates availability impact, with no stated confidentiality or integrity impact.
Which Blender versions need to be updated?
Blender versions before 4.5.15 are affected, as are 5.x versions before 5.2.3. Install a version at or newer than the applicable fixed release.