Heap Out-of-Bounds Access Vulnerability in Blender by Blender Foundation

CVE-2026-119722

What is CVE-2026-119722?

Blender versions prior to 4.5.15 and 5.x before 5.2.3 contain a heap out-of-bounds access vulnerability in the read_struct() method. This vulnerability arises when the size validation is bypassed during the comparison of .blend file's SDNA struct layout, allowing attackers to craft malicious .blend files with short blocks. Consequently, improper field reads, writes, and pointer dereferences can lead to heap memory overruns, potentially causing application crashes or enabling arbitrary code execution.

References