Skip to main content

Blender CVE-2026-60103

MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-13 VulnCheck
6.8
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

File-open triggers the flaw locally (AV:L, UI:R); no privileges needed; crash is primary impact (A:H) with limited heap read (C:L); no integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 13, 2026 - 19:44 vuln.today
CVE Published
Jul 13, 2026 - 17:44 cve.org
MEDIUM 6.8

DescriptionCVE.org

Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

AnalysisAI

Out-of-bounds read in Blender 3.0.0 through 5.1.2 allows an attacker to crash the application or disclose heap memory contents by convincing a user to open a specially crafted .blend file containing a malicious member_index value in the SDNA block. The vulnerability stems from missing bounds validation on a signed short index used directly as an array subscript in sdna_expand_names(), enabling both denial-of-service via SIGSEGV and limited heap memory disclosure. No public exploit code or active exploitation has been identified at time of analysis, but the file-based attack vector makes social engineering a realistic delivery mechanism.

Technical ContextAI

Blender uses a binary file format (.blend) that includes an SDNA (Structure DNA) block encoding the data layout of internal C structs. During file loading, sdna_expand_names() iterates member definitions and uses the member_index field - a signed short - as a direct index into the sdna->members[] array. Because the field is not validated against array bounds, a crafted negative or out-of-range value produces an invalid pointer that is subsequently passed to strlen(), triggering a SIGSEGV crash or causing Blender to read attacker-influenced heap memory. The root cause class is CWE-125 (Out-of-Bounds Read). Affected product is identified by CPE cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*, covering all builds from 3.0.0 to 5.1.2 across platforms.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - monitor the Blender release page and apply the next stable release once it incorporates commit 968972a918b5ed2d534295b639c54449d7de11cd, referenced at https://projects.blender.org/blender/blender/commit/968972a918b5ed2d534295b639c54449d7de11cd. Until a patched release is available, the primary compensating control is to prohibit opening untrusted .blend files from external or unverified sources; this eliminates the user-interaction prerequisite and fully blocks the attack path. Organizations can enforce this via file-origin policies or by using sandboxed environments (e.g., containers or VMs with no network egress and no sensitive data) when processing externally sourced .blend files. Note that sandboxing mitigates impact but does not eliminate the crash or memory read. Building Blender from source with the patched commit applied is an option for pipeline-critical environments that cannot wait for an official release.

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-60103 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy