UBUNTU-CVE-2026-119721: Medium severity ubuntu/blender vulnerability
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blobheadid accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
Affected Software
Event History
Frequently Asked Questions
Which Blender workflows can trigger the issue?
The issue can be triggered when a crafted .blend file is browsed or used as a source for appending data.
What must an attacker provide to exploit this vulnerability?
An attacker must supply a crafted .blend file containing short ID blocks. Exploitation requires a user to browse or append from that file.
What are the potential effects of successful exploitation?
The out-of-bounds reads can cause Blender to crash or disclose heap memory.
Which versions are affected and which versions contain the fix?
Blender versions before 4.5.15 are affected, as are 5.x versions before 5.2.3. Updating to 4.5.15 or later, or to 5.2.3 or later on the 5.x line, addresses the issue.