Blender CVE-2026-119718

Exploitation requires the victim to open, within an affected Blender version (before 4.5.15, or 5.x before 5.2.3), a malicious point cache file carrying an abnormally large totpoint value alongside an attacker-supplied .blend file; the oversized value drives the integer overflow in ptcache_data_alloc() during point cache reading. Limiting factors confirmed by the CVSS vector: the attack is local (AV:L) and requires passive user interaction (UI:P) - there is no network or remote trigger, and the attacker must induce the user to load the crafted files. PR:N means no authentication is needed once the file is opened. The only complete fix stated by the evidence is updating to a fixed version.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.5 because the three impact metrics are all High (code execution as the user), but exploitation is gated by two factors the base score makes explicit: the attack vector is Local (AV:L) and passive user interaction is required (UI:P) - the victim must open an attacker-supplied .blend file plus a crafted point cache file. There is no remote/network path. No EPSS probability was supplied and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation; the only exploitation framework signal present is the vuln.today decision label 'this_week', which argues for prompt but not emergency patching. The report originates from VulnCheck, a credible research source, and a vendor patch exists. Net assessment: a real memory-corruption flaw with code-execution potential in a very widely used product, but realistic risk depends entirely on social-engineering a user into opening malicious scene files, so it is a patch-this-week item, not an actively-exploited internet-facing crisis.

An attacker distributes a Blender scene - for example a free model, asset pack, or project file shared on a marketplace or forum - that bundles a malicious point cache file crafted with an oversized totpoint value. When the victim opens the .blend file in an unpatched Blender, the integer overflow in ptcache_data_alloc() undersizes a heap buffer that is then overflowed, crashing Blender or executing code with the victim's privileges. No public exploit was identified at time of analysis; the described trigger comes from the VulnCheck advisory and vendor commits.