EUVD-2026-114124
GHSA-27m9-m9xq-2vm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted .blend file to victim
-
ExploitThumbnailer/Windows shell extension previews file
-
ExecutionInteger overflow in thumb_data_vertical_flip triggers heap OOB write
-
ImpactCrash or arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to have a crafted .blend file present locally and previewed - either by the blender-thumbnailer utility or by the Windows shell extension generating a thumbnail when the user browses the containing folder. The file must carry malicious TEST block dimensions that drive the 32-bit integer overflow in thumb_data_vertical_flip(). Limiting factors (per CVSS AV:L/UI:P/PR:N): the attack is local, not network-remote, and needs passive user interaction (file preview); no authentication or elevated privileges are required. Affected builds are Blender before 4.5.15 and 5.x before 5.2.3; systems already updated to 4.5.15 or 5.2.3 are not exploitable. |
| Impact | The input CVSS 4.0 score of 8.5 (High) reflects full technical impact (VC:H/VI:H/VA:H) but a local attack vector (AV:L) with passive user interaction (UI:P), so this is not a remotely exploitable or wormable flaw - a victim must obtain a crafted .blend file and have it previewed locally. No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active or widespread exploitation; this is 'no public exploit identified at time of analysis' (the VulnCheck entry is an advisory reference, not verified working exploit code). The vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a serious but not actively-exploited memory-corruption bug. The notable risk amplifier is the Windows shell extension path: thumbnail generation can be triggered simply by browsing a folder in Explorer, lowering the user-interaction burden below that of explicitly opening a file. Code execution is described as a possible outcome by the advisory and CWE-190 class, but is not confirmed as demonstrated in the available data. |
| Exploit ScenarioDerived | An attacker distributes a crafted .blend file with malicious TEST block dimensions via download, email attachment, or a shared/network drive. When the victim browses the containing folder in Windows Explorer (triggering the shell extension) or runs blender-thumbnailer, the thumbnail extractor's thumb_data_vertical_flip() hits a 32-bit integer overflow and performs an out-of-bounds heap write, causing a crash or potential arbitrary code execution. No public exploit code is identified at time of analysis, and exploitation requires local file preview with passive user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Heap-based buffer overflow in Blender's .blend thumbnail extractor (blender-thumbnailer and the Windows shell extension) allows memory corruption and potential code execution or crash when a crafted .blend file is previewed. The flaw is a 32-bit integer overflow in thumb_data_vertical_flip() that is driven by malicious TEST block dimensions in the file, producing an out-of-bounds write. Affected builds are Blender before 4.5.15 and 5.x before 5.2.3, with fixes released in 4.5.15 and 5.2.3; exploitation is local with passive user interaction (file preview) and no public exploit has been identified at time of analysis.
RemediationAI
Apply the vendor-released patch by upgrading Blender 4.x installations to 4.5.15 and Blender 5.x installations to 5.2.3; these are the exact fixed versions listed for this CVE, and hosts on either release or later are no longer exposed. The fix is contained in upstream pull request 164279 (commits d723c68112d216099c9b24dab5c8440bab7add08 and 71c10a0217d5e331b215b76773ad23b64974bd97) at https://projects.blender.org/blender/blender, and the VulnCheck advisory at https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-thumbnail-extraction summarizes the flaw. Prioritize updating endpoints where untrusted .blend files are handled and where the Windows shell extension or blender-thumbnailer processes files automatically, since those are the components through which the overflow is triggered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) and occurs inside thumb_data_vertical_flip(), the routine Blender's thumbnail pipeline uses to vertically flip decoded thumbnail pixel data. Because the arithmetic handling the image row/stride or size calculation is 32-bit, attacker-controlled dimensions recorded in a .blend file's TEST block can wrap the computed value, so a subsequently sized or offset write lands outside the allocated heap buffer. The overflow is reachable through the thumbnail extraction paths specifically - the command-line blender-thumbnailer utility and the Windows shell extension that generates previews when a folder containing a .blend file is browsed - rather than through normal interactive scene loading described in the available sources. Per the CPE (cpe:2.3:a:blender_foundation:blender:*:*:*:*:*:*:*:*) the affected code base is the Blender Foundation's Blender application across all pre-4.5.15 releases and 5.x releases before 5.2.3.
Know when Blender gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Triggered by previewing an attacker-supplied local file with passive user interaction and no auth (AV:L/UI:R/PR:N); heap corruption enabling code execution gives C/I/A High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.
Executive ViewAI
A heap-based buffer overflow in Blender's thumbnail handling affects versions prior to 4.5.15 and 5.2.3, enabling memory corruption and potential code execution if a user previews a malicious .blend file. This poses a risk of unauthorized code execution on design workstations and file servers with thumbnail previews enabled, potentially leading to data compromise or lateral movement. Leadership should prioritize patching due to the high severity and passive user interaction required.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Endless Infinite loop in Blender-thumnailing due to logical bugs. Rated high severity (CVSS 7.5), this vulnerability is
A flaw was found in Blender 3.3.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authen
A flaw was found in Blender 3.3.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authen
Heap out-of-bounds memory access in Blender's .blend file parsing path (read_struct()) can crash Blender or potentially
A heap buffer overflow in Blender's point cache loading path, driven by an integer overflow in ptcache_data_alloc(), aff
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing a
An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds
Out-of-bounds heap reads in Blender's .blend file loader let a crafted file crash the application or leak process memory
Out-of-bounds read in Blender 3.0.0 through 5.1.2 allows an attacker to crash the application or disclose heap memory co
Opening a crafted .blend file in a vulnerable Blender build causes a heap out-of-bounds read inside read_file_dna() and
An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read
Exploit-DB