Out-of-Bounds Read Vulnerability in Blender by Blender Foundation

CVE-2026-119721

What is CVE-2026-119721?

Blender versions prior to 4.5.15 and 5.x before 5.2.3 have a vulnerability that allows attackers to exploit out-of-bounds read conditions. This can occur in the blo_bhead_id_* accessors within readfile.cc, where ID fields are accessed without proper block length checks. By crafting a *.blend file with short ID blocks, an attacker may trigger heap over-reads when the file is accessed, leading to potential application crashes or unexpected memory disclosures.

References