CVE-2026-119718

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119718", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T14:49:27.932Z", "datePublished": "2026-10-30T15:16:15.633Z", "dateUpdated": "2026-10-30T15:42:41.053Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T15:16:15.633Z"}, "datePublic": "2026-10-13T00:00:00.000Z", "title": "Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache", "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}], "affected": [{"vendor": "Blender Foundation", "product": "Blender", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "4.5.15", "status": "affected", "versionType": "semver"}, {"version": "5.0.0", "lessThan": "5.2.3", "status": "affected", "versionType": "semver"}], "repo": "https://projects.blender.org/blender/blender"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.5.15"}, {"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.2.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://projects.blender.org/blender/blender/pulls/164279", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/a0c62db3db61803f86e874bc05407890ce4a1e43", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/4f8a3270213b1ee67b44fe122ace3debdec3de47", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender", "tags": ["product"]}, {"name": "VulnCheck Advisory: Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-point-cache"}], "credits": [{"lang": "en", "value": "Tristan Madani", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:42:31.699693Z", "id": "CVE-2026-119718", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:42:41.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119718", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T15:42:31.699693Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:42:36.895Z"}}], "cna": {"title": "Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache", "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://projects.blender.org/blender/blender", "vendor": "Blender Foundation", "product": "Blender", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.15", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-13T00:00:00.000Z", "references": [{"url": "https://projects.blender.org/blender/blender/pulls/164279", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/a0c62db3db61803f86e874bc05407890ce4a1e43", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/4f8a3270213b1ee67b44fe122ace3debdec3de47", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-point-cache", "name": "VulnCheck Advisory: Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.5.15"}, {"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.2.3", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T15:16:15.633Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119718", "state": "PUBLISHED", "dateUpdated": "2026-10-30T15:42:41.053Z", "dateReserved": "2026-10-30T14:49:27.932Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T15:16:15.633Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Blender", "repo": "https://projects.blender.org/blender/blender", "vendor": "Blender Foundation", "versions": [{"lessThan": "4.5.15", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.2.3", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA082A72-9D71-4D38-BE01-822D6B8E0D89", "versionEndExcluding": "4.5.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "matchCriteriaId": "5173A6E2-9FB9-4A20-9A55-46A4E77A34DE", "versionEndExcluding": "5.2.3", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user."}], "id": "CVE-2026-119718", "lastModified": "2026-11-03T13:58:19.923", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119718", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T15:42:31.699693Z", "version": "2.0.3"}}]}, "published": "2026-10-30T16:17:55.310", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://projects.blender.org/blender/blender"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://projects.blender.org/blender/blender/commit/4f8a3270213b1ee67b44fe122ace3debdec3de47"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://projects.blender.org/blender/blender/commit/a0c62db3db61803f86e874bc05407890ce4a1e43"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch"], "url": "https://projects.blender.org/blender/blender/pulls/164279"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-point-cache"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "blender: blender: Arbitrary code execution via crafted point cache file", "id": "2564158", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564158"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.", "A flaw was found in Blender. An integer overflow issue in the point cache allocation function (ptcache_data_alloc()) leads to a heap-based buffer overflow when reading point cache data. An attacker could exploit this vulnerability by convincing a user to load a specially crafted point cache file alongside a project file, potentially leading to arbitrary code execution or a Denial of Service (DoS) crash."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-11-03) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to trap signed integer arithmetic overflow during buffer size calculation in ptcache_data_alloc() to abort execution before an undersized heap allocation occurs: upgrade to blender 4.5.15, 5.2.3 (or the fixed Blender builds), which validate calculation bounds in ptcache_data_alloc() to prevent integer overflow when reading point cache files with large totpoint values, closing all 2 injection vectors (crafted point cache file, untrusted .blend project file). Until patched, this is a concern on workstations and systems running Blender where users load untrusted project and point cache files, so prevent users from opening untrusted .blend project files and point cache files from unverified sources. As a compensating measure, enable Address Space Layout Randomization to randomize Blender userspace memory layout, enforce full RELRO and PIE to protect the Global Offset Table and randomize binary code addresses, apply Control Flow Integrity to restrict indirect call and jump targets, validate totpoint values against upper bounds before memory allocation, deploy EDR agents to monitor anomalous process behavior spawned from Blender sessions, and enforce non-executable memory permissions on heap pages via NX/XD bit. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow heap-buffer-overflow defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)"}, "name": "CVE-2026-119718", "public_date": "2026-10-30T15:16:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119718\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119718\nhttps://projects.blender.org/blender/blender\nhttps://projects.blender.org/blender/blender/commit/4f8a3270213b1ee67b44fe122ace3debdec3de47\nhttps://projects.blender.org/blender/blender/commit/a0c62db3db61803f86e874bc05407890ce4a1e43\nhttps://projects.blender.org/blender/blender/pulls/164279\nhttps://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-point-cache"], "statement": "This vulnerability is evaluated with an Important severity rating because successful exploitation allows arbitrary code execution within the privileges of the active user session. In Red Hat environments, Blender is not deployed as a standard core service, and exposure is primarily confined to graphical workstations where the application is explicitly installed. The vulnerability requires user interaction to open an untrusted project file along with malicious point cache data, preventing automated or unauthenticated remote attacks.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.5.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.2.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Blender", "source": "cna", "vendor": "Blender Foundation"}, "product": "blender", "vendor": "blender"}], "created": "2026-10-30T17:15:14.901194+00:00", "updated": "2026-11-04T11:15:08.428830+00:00", "vendors": ["blender", "blender$PRODUCT$blender"]}