Blender CVE-2026-60103

Exploitation requires the target to open a crafted .blend file in Blender 3.0.0 through 5.1.2; this is the sole prerequisite and is encoded in the CVSS vector as UI:A (active user interaction). The vulnerable code path (sdna_expand_names()) is triggered during normal .blend file loading, so no non-default feature, plugin, or configuration setting is required - any standard Blender installation that opens the crafted file is vulnerable. Limiting factors: the attack is entirely local and file-triggered (AV:L), meaning the attacker cannot reach Blender over a network without first delivering the file; the attacker requires no authentication or system privileges. The confidentiality impact is bounded to heap memory contents local to the Blender process (VC:L), not OS-level secrets. Exploitation on systems where users do not open externally sourced .blend files is not realistic.

The CVSS 4.0 score of 6.8 reflects a local, user-interaction-required attack with high availability impact and low confidentiality impact - accurately capturing the realistic threat model. The attack vector AV:L paired with UI:A means exploitation is gated on a user actively opening a malicious file; this is not a remotely triggerable flaw against a listening service. There is no EPSS data provided, no CISA KEV listing, and no public POC referenced, all of which are consistent with a medium-priority finding. The heap disclosure component (VC:L) is limited and non-deterministic, reducing its utility for targeted memory-leak exploitation in practice. The primary real-world risk is availability disruption - crashing Blender during file open - which is significant for production pipelines but not a critical security priority compared to remote code execution flaws. The patch is referenced via a commit but no specific fixed release version is confirmed, which is a data gap.

An attacker crafts a .blend file with a malformed SDNA block containing a member_index value outside the valid range of the sdna->members[] array, then delivers it to a Blender user via email attachment, file-sharing platform, or a compromised asset repository. When the target opens the file, sdna_expand_names() dereferences the invalid pointer, either crashing Blender (SIGSEGV) or reading and potentially exposing adjacent heap contents. No public POC has been identified, but the file-parsing nature of the flaw makes manual reproduction straightforward for a skilled researcher.