CVE-2026-119719

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119719", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T14:49:28.319Z", "datePublished": "2026-10-30T15:16:16.337Z", "dateUpdated": "2026-11-04T22:56:02.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T15:16:16.337Z"}, "datePublic": "2026-10-13T00:00:00.000Z", "title": "Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction", "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}], "affected": [{"vendor": "Blender Foundation", "product": "Blender", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "4.5.15", "status": "affected", "versionType": "semver"}, {"version": "5.0.0", "lessThan": "5.2.3", "status": "affected", "versionType": "semver"}], "repo": "https://projects.blender.org/blender/blender"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.5.15"}, {"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.2.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://projects.blender.org/blender/blender/pulls/164279", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/d723c68112d216099c9b24dab5c8440bab7add08", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/71c10a0217d5e331b215b76773ad23b64974bd97", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender", "tags": ["product"]}, {"name": "VulnCheck Advisory: Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-thumbnail-extraction"}], "credits": [{"lang": "en", "value": "Tristan Madani", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T22:55:50.193042Z", "id": "CVE-2026-119719", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T22:56:02.873Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119719", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-04T22:55:50.193042Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T22:55:58.569Z"}}], "cna": {"title": "Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction", "credits": [{"lang": "en", "type": "finder", "value": "Tristan Madani"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://projects.blender.org/blender/blender", "vendor": "Blender Foundation", "product": "Blender", "versions": [{"status": "affected", "version": "0", "lessThan": "4.5.15", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-13T00:00:00.000Z", "references": [{"url": "https://projects.blender.org/blender/blender/pulls/164279", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/d723c68112d216099c9b24dab5c8440bab7add08", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/71c10a0217d5e331b215b76773ad23b64974bd97", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-thumbnail-extraction", "name": "VulnCheck Advisory: Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.5.15"}, {"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.2.3", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T15:16:16.337Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119719", "state": "PUBLISHED", "dateUpdated": "2026-11-04T22:56:02.873Z", "dateReserved": "2026-10-30T14:49:28.319Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T15:16:16.337Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Blender", "repo": "https://projects.blender.org/blender/blender", "vendor": "Blender Foundation", "versions": [{"lessThan": "4.5.15", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.2.3", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA082A72-9D71-4D38-BE01-822D6B8E0D89", "versionEndExcluding": "4.5.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "matchCriteriaId": "5173A6E2-9FB9-4A20-9A55-46A4E77A34DE", "versionEndExcluding": "5.2.3", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution."}], "id": "CVE-2026-119719", "lastModified": "2026-11-04T23:17:22.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119719", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T22:55:50.193042Z", "version": "2.0.3"}}]}, "published": "2026-10-30T16:17:55.473", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://projects.blender.org/blender/blender"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://projects.blender.org/blender/blender/commit/71c10a0217d5e331b215b76773ad23b64974bd97"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://projects.blender.org/blender/blender/commit/d723c68112d216099c9b24dab5c8440bab7add08"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch"], "url": "https://projects.blender.org/blender/blender/pulls/164279"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-thumbnail-extraction"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "blender: blender: Arbitrary code execution via thumbnail extractor integer overflow", "id": "2564160", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564160"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.", "A flaw was found in Blender. This vulnerability may allow arbitrary code execution or cause an application crash resulting in a Denial of Service (DoS). By convincing a user to preview a specially crafted blend file with invalid image dimensions, an attacker can trigger an integer overflow in the thumbnail extractor. This condition leads to an out-of-bounds memory write, potentially enabling unauthorized code execution in the context of the user."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-11-03) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to validate TEST block image dimensions and bounds before arithmetic operations in thumb_data_vertical_flip() during thumbnail extraction: upgrade to blender 4.5.15, 5.2.3+ (or the fixed Blender builds), which validates TEST block image dimensions and size parameters prior to processing in thumb_data_vertical_flip() to prevent integer overflow and heap buffer corruption, closing all 2 injection vectors (file preview via blender-thumbnailer, file preview via Windows shell extension). Until patched, this is a concern on systems and user sessions previewing or handling .blend files with Blender thumbnail extractors enabled, so disable thumbnail generation for .blend files in file managers and Windows Explorer, and avoid previewing or opening untrusted .blend files. As a compensating measure, randomize process memory layout using ASLR to obstruct reliable execution of ROP chains or shellcode following heap buffer overflow, compile binaries with Full RELRO and PIE to prevent Global Offset Table overwrites via heap corruption, enforce forward-edge control flow integrity to block hijacked indirect calls resulting from corrupted heap pointers, enforce Arbitrary Code Guard on Windows to block dynamic allocation of executable pages during shell extension thumbnail extraction, and enforce NX/XD non-executable page protections to prevent execution of payloads placed in heap memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)"}, "name": "CVE-2026-119719", "public_date": "2026-10-30T15:16:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119719\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119719\nhttps://projects.blender.org/blender/blender\nhttps://projects.blender.org/blender/blender/commit/71c10a0217d5e331b215b76773ad23b64974bd97\nhttps://projects.blender.org/blender/blender/commit/d723c68112d216099c9b24dab5c8440bab7add08\nhttps://projects.blender.org/blender/blender/pulls/164279\nhttps://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-thumbnail-extraction"], "statement": "This vulnerability is rated as Important severity because successful exploitation allows arbitrary code execution or process termination under the privileges of the executing user, despite requiring user interaction. The flaw is triggered when thumbnail preview handlers process malformed project files, potentially enabling an attacker to compromise local user sessions. Blender is not shipped or supported in core Red Hat Enterprise Linux and is only distributed through community repositories like EPEL, which limits enterprise attack surface.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.5.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.2.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Blender", "source": "cna", "vendor": "Blender Foundation"}, "product": "blender", "vendor": "blender"}], "created": "2026-10-30T16:45:15.105958+00:00", "updated": "2026-11-04T11:15:08.428154+00:00", "vendors": ["blender", "blender$PRODUCT$blender"]}