Source: blender Version: 5.2.2+dfsg-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for blender. CVE-2026-119718[0]: | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer | overflow vulnerability caused by integer overflow in | ptcache_data_alloc() when reading point cache files. Attackers can | supply a crafted point cache file with a large totpoint value | alongside a .blend file to crash Blender or execute code as the | user. CVE-2026-119719[1]: | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer | overflow vulnerability in the blend file thumbnail extractor caused | by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers | can craft a .blend file with malicious TEST block dimensions that | trigger an out-of-bounds write when blender-thumbnailer or the | Windows shell extension previews it, causing crashes or code | execution. CVE-2026-119720[2]: | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of- | bounds read vulnerability in read_file_dna() that reads a GLOB block | field without validating its declared length. Attackers can supply a | crafted .blend file with a truncated GLOB block that, when opened, | triggers the out-of-bounds read and crashes Blender. CVE-2026-119721[3]: | Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds | read vulnerability in blo_bhead_id_* accessors in readfile.cc that | read ID fields without block length checks. Attackers can supply a | crafted .blend file with short ID blocks that, when browsed or | appended from, causes heap over-reads leading to crashes or heap | memory disclosure. CVE-2026-119722[4]: | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of- | bounds access vulnerability in read_struct() that skips size | validation when a .blend file's SDNA struct layout compares equal. | Attackers can supply a crafted .blend file with short blocks so | field reads, writes, and pointer dereferences overrun heap memory, | causing crashes or code execution. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-119718 https://www.cve.org/CVERecord?id=CVE-2026-119718 [1] https://security-tracker.debian.org/tracker/CVE-2026-119719 https://www.cve.org/CVERecord?id=CVE-2026-119719 [2] https://security-tracker.debian.org/tracker/CVE-2026-119720 https://www.cve.org/CVERecord?id=CVE-2026-119720 [3] https://security-tracker.debian.org/tracker/CVE-2026-119721 https://www.cve.org/CVERecord?id=CVE-2026-119721 [4] https://security-tracker.debian.org/tracker/CVE-2026-119722 https://www.cve.org/CVERecord?id=CVE-2026-119722 Regards, Salvatore
