CVE-2026-119722

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119722", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T14:49:29.492Z", "datePublished": "2026-10-30T15:16:18.421Z", "dateUpdated": "2026-10-30T15:43:14.258Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T15:16:18.421Z"}, "datePublic": "2026-10-13T00:00:00.000Z", "title": "Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()", "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "Blender Foundation", "product": "Blender", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "4.5.15", "status": "affected", "versionType": "semver"}, {"version": "5.0.0", "lessThan": "5.2.3", "status": "affected", "versionType": "semver"}], "repo": "https://projects.blender.org/blender/blender"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.5.15"}, {"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.2.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://projects.blender.org/blender/blender/pulls/164279", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender", "tags": ["product"]}, {"name": "VulnCheck Advisory: Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct"}], "credits": [{"lang": "en", "value": "Tristan Madani", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:43:02.180191Z", "id": "CVE-2026-119722", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:43:14.258Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119722", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T14:49:29.492Z", "datePublished": "2026-10-30T15:16:18.421Z", "dateUpdated": "2026-10-30T15:43:14.258Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T15:16:18.421Z"}, "datePublic": "2026-10-13T00:00:00.000Z", "title": "Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()", "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "Blender Foundation", "product": "Blender", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "4.5.15", "status": "affected", "versionType": "semver"}, {"version": "5.0.0", "lessThan": "5.2.3", "status": "affected", "versionType": "semver"}], "repo": "https://projects.blender.org/blender/blender"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.5.15"}, {"vulnerable": true, "criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.2.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://projects.blender.org/blender/blender/pulls/164279", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e", "tags": ["patch"]}, {"url": "https://projects.blender.org/blender/blender", "tags": ["product"]}, {"name": "VulnCheck Advisory: Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct"}], "credits": [{"lang": "en", "value": "Tristan Madani", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T15:43:02.180191Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:43:07.623Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Blender", "repo": "https://projects.blender.org/blender/blender", "vendor": "Blender Foundation", "versions": [{"lessThan": "4.5.15", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.2.3", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA082A72-9D71-4D38-BE01-822D6B8E0D89", "versionEndExcluding": "4.5.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*", "matchCriteriaId": "5173A6E2-9FB9-4A20-9A55-46A4E77A34DE", "versionEndExcluding": "5.2.3", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution."}], "id": "CVE-2026-119722", "lastModified": "2026-11-03T16:10:35.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119722", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T15:43:02.180191Z", "version": "2.0.3"}}]}, "published": "2026-10-30T16:17:55.907", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://projects.blender.org/blender/blender"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch"], "url": "https://projects.blender.org/blender/blender/pulls/164279"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "blender: blender: Arbitrary code execution via crafted .blend file", "id": "2564155", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564155"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.", "A flaw was found in Blender. This vulnerability allows an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by convincing a user to open a specially crafted project file. Because the application fails to properly validate structure sizes during file parsing, memory overruns occur on the heap, potentially compromising system integrity."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-11-03) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to enforce structure size validation during SDNA struct parsing in read_struct(): upgrade to Blender 4.5.15 and 5.2.3 (or the fixed Blender builds), which validates structure sizes in read_struct() even when SDNA struct layouts compare equal to prevent heap overruns on short blocks, closing crafted .blend project file with short blocks. Until patched, this is a concern on workstations and user sessions opening untrusted .blend project files, so restrict opening untrusted or externally sourced .blend files and prevent processing unvetted media assets. As a compensating measure, enable ASLR to randomize userspace memory layout and prevent reliable targeting of predictable heap addresses, enforce full RELRO and PIE to protect the Global Offset Table from being overwritten during heap corruption, deploy Control Flow Integrity or Shadow Call Stack to restrict indirect branch targets and mitigate ROP/JOP execution, configure EDR agents to monitor for and detect anomalous child processes or shell executions spawned from Blender, and enforce NX/XD bit protections to ensure heap and data memory regions remain non-executable. These controls limit blast radius and contain exploitation, but they do not fix the underlying heap out-of-bounds access defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)"}, "name": "CVE-2026-119722", "public_date": "2026-10-30T15:16:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119722\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119722\nhttps://projects.blender.org/blender/blender\nhttps://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e\nhttps://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5\nhttps://projects.blender.org/blender/blender/pulls/164279\nhttps://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct"], "statement": "This vulnerability is rated as Important severity because successful exploitation allows arbitrary code execution within the context of the running user session, though it requires user interaction rather than being directly exploitable over the network. In Red Hat environments, Blender is available as an optional package in EPEL and Fedora rather than standard enterprise server deployments, confining exposure to workstations processing external media assets. Impact is constrained to the permissions and filesystem access privileges granted to the user launching the application.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.5.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.2.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Blender", "source": "cna", "vendor": "Blender Foundation"}, "product": "blender", "vendor": "blender"}], "created": "2026-10-30T16:30:16.125250+00:00", "updated": "2026-11-04T11:00:15.375696+00:00", "vendors": ["blender", "blender$PRODUCT$blender"]}